EUVD-2026-33442
GHSA-jxxr-4gwj-5jf2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft string with oversized brace range
-
DeliverySend input to vulnerable endpoint
-
ExploitFunction begins expansion
-
ExecutionLoop builds full intermediate array ignoring max
-
PersistExcessive memory/time consumption
-
ImpactService hang or crash
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Untrusted input must be passed directly to the |
| Impact | The CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates an easily exploitable network vulnerability leading to high availability impact. However, EPSS is only 0.03% (11th percentile), suggesting very low real-world exploitation likelihood. The fix commit includes a test demonstrating the DoS, so a proof of concept exists but no weaponized exploit or active exploitation (not listed in CISA KEV). SSVC assessment would favour low urgency given the low EPSS and absence of active attacks. The library's impact depends on how applications consume untrusted input for expansion; default configurations often don't expose a |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a web application that uses brace-expansion internally, supplying a string like |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 27, 2026
Denial of service in brace-expansion versions 5.0.0 through 5.0.5 allows remote attackers to cause excessive resource consumption. When an application passes untrusted input to the expand function with a numeric max limit, a crafted string containing a single large numeric range (e.g., {1..10000000}) triggers allocation of a massive intermediate array before the limit is applied, leading to memory exhaustion and service disruption. No active exploitation has been reported, and the low EPSS score (0.03%) indicates a low probability of widespread attacks.
RemediationAI
Upgrade to brace-expansion version 5.0.6 or later, available via npm (npm update brace-expansion@5.0.6). The patch commit (https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5) adds the max check inside the expansion loop, preventing excessive allocations. As a temporary workaround, sanitise user input to remove large numeric brace ranges before calling the library, or restrict the maximum range size at the application level. Note that this workaround may break legitimate brace expansion patterns; thorough input validation is required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
brace-expansion is an npm library that implements brace expansion (like {1..5} → 1 2 3 4 5) commonly used in shells and build tools. The root cause is CWE-400 Uncontrolled Resource Consumption: the sequence generation loop allocates all intermediate elements regardless of the max option, only capping the output array at the end. The affected code is in the expand_ function in src/index.ts. The package is identified by CPE pkg:npm/brace-expansion.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible via crafted input; no auth needed; memory exhaustion causes DoS
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
The max option was being applied too late:
When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array.
Workaround
Ensure the string to be expanded doesn't contain more values than the desired max item count.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB