CVE-2026-33750
HIGHVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS v3.1 score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates network-accessible denial of service with low attack complexity and no privilege requirements, but requiring user interaction. The practical risk is moderate-to-high for applications that automatically expand untrusted brace patterns from external sources (CLI tools, configuration file parsers, glob-based file discovery systems) without user interaction constraints. However, systems requiring explicit user invocation to trigger pattern expansion face lower real-world risk. No EPSS score, KEV status, or public exploit code is indicated in available intelligence. The lightweight input requirement (10 bytes) and deterministic resource exhaustion make this a viable attack vector against automated pattern processing pipelines. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability in a command-line glob utility by providing a malicious file pattern argument such as '{1..2..0}' (10 bytes), causing the application to hang for 3.5 seconds and allocate approximately 1.9 GB of memory before crashing. In a CI/CD pipeline or automated file discovery system, such patterns embedded in configuration files could be triggered without user interaction, causing resource starvation and denial of service to other processes. A web application accepting brace-expansion patterns from user input or configuration files would similarly become unresponsive when processing such input, degrading availability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Brace-expansion library versions prior to 5.0.5 allow unauthenticated remote attackers to cause denial of service through resource exhaustion by supplying brace expansion patterns with zero step values (e.g., {1..2..0}), triggering an infinite loop that consumes gigabytes of memory and hangs the process for seconds. The vulnerability affects any application passing untrusted input to the expand() function, including glob/minimatch-based tools consuming CLI arguments or configuration files, and requires only 10 bytes of malicious input to trigger.
RemediationAI
Upgrade the brace-expansion package to version 5.0.5 or later, where step increment values of 0 are now sanitized to 1, matching bash behavior. For applications unable to immediately upgrade dependencies, implement input sanitization at the application level to reject or normalize brace expansion patterns containing explicit zero step values before passing them to the expand() function. Additionally, consider restricting pattern expansion to trusted sources and implementing timeouts on pattern expansion operations to fail safely if resource consumption exceeds thresholds. Review all direct and transitive dependencies on brace-expansion via dependency auditing tools and update package-lock.json or yarn.lock files after patching.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The brace-expansion library (pkg:npm/brace-expansion) implements bash-style brace expansion pattern processing. The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and stems from a sequence generation loop in src/index.ts (line 184) that fails to validate step increment values. When a step value of 0 is provided in a range pattern, the increment is computed as Math.abs(0) = 0, causing the loop variable to never advance and the test() condition to never terminate. The vulnerability exists because validation occurs only at the output combination stage rather than during sequence generation, allowing unbounded memory allocation during the infinite loop phase.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Impact
A brace pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.
The loop in question:
https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
test() is one of
https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
The increment is computed as Math.abs(0) = 0, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a RangeError. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.
This affects any application that passes untrusted strings to expand(), or by error sets a step value of 0. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.
Patches
Upgrade to versions
- 5.0.5+
A step increment of 0 is now sanitized to 1, which matches bash behavior.
Workarounds
Sanitize strings passed to expand() to ensure a step value of 0 is not used.
Executive ViewAI
CVE-2026-33750 presents notable security risk, a resource exhaustion vulnerability rated CVSS 6.5. Service availability could be impacted. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement rate limiting and resource quotas.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB