EUVD-2025-17567
GHSA-v6h2-p8h4-qcjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious brace pattern
-
DeliverySend to application using brace-expansion
-
ExploitApplication calls expand()
-
ExecutionRegex backtracking consumes CPU
-
ImpactDenial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2021 - Security Misconfiguration
ASVS 5.0
V14 - Configuration Security hardening, default configuration review
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to supply input to an application that uses the brace-expansion library's |
| Impact | The CVSS 4.0 vector indicates a low severity (1.3) with high attack complexity (AC:H) and low privileges required (PR:L). The EPSS score is very low (0.03%, percentile 8%), suggesting minimal exploitation likelihood. No CISA KEV listing exists. The exploit is publicly disclosed, but the high complexity and low impact (only availability impact) make this a low-priority issue for most environments. The SSVC decision would likely be 'Track' rather than 'Act'. |
| Exploit ScenarioDerived | An attacker with low privileges (e.g., a user able to supply input to an application that uses brace-expansion) can craft a string like |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 26, 2026
Inefficient regular expression complexity in brace-expansion up to versions 1.1.11/2.0.1/3.0.0/4.0.0 allows remote attackers to cause a denial of service via a crafted brace pattern. The vulnerability is publicly known with a proof of concept, but exploitation is difficult due to high attack complexity and low EPSS score (0.03%). No active exploitation in the wild has been reported.
Earlier versions of this analysis (1)
RemediationAI
Upgrade brace-expansion to version 1.1.12, 2.0.2, 3.0.1, or 4.0.1, depending on the major version in use. The patch commit is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. For Debian and Ubuntu systems, apply the respective security updates. No workarounds are available; the only mitigation is to update the package.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a ReDoS (Regular Expression Denial of Service) in the expand function of index.js in the brace-expansion npm package. The CWE-400 (Uncontrolled Resource Consumption) root cause is a regex that can exhibit catastrophic backtracking when processing specially crafted input with many commas. The affected regex is m.post.match(/,.*\}/) which is replaced with m.post.match(/,(?!,).*\}/) in the fix. The package is widely used as a dependency in many JavaScript projects, including npm itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
High complexity due to crafted input; low privileges; only availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
Blast Radius
ecosystem impact- 1 npm packages depend on brace-expansion (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
Executive ViewAI
CVE-2025-5889 is a low-severity vulnerability in juliangruber brace-expansion involving resource exhaustion (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard denial of service mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | released | 2.0.1+~1.1.0-2 |
| plucky | ignored | end of life, was needs-triage |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1107695| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 2.0.0-1 | - |
| bookworm | vulnerable | 2.0.1-2 | - |
| forky, sid, trixie | fixed | 2.0.1+~1.1.0-2 | - |
| (unstable) | fixed | 2.0.1+~1.1.0-2 | - |
Exploit-DB