EUVD-2025-17567
GHSA-v6h2-p8h4-qcjw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High complexity due to crafted input; low privileges; only availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 npm packages depend on brace-expansion (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.0.0.
DescriptionCVE.org
A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.
AnalysisAI
Inefficient regular expression complexity in brace-expansion up to versions 1.1.11/2.0.1/3.0.0/4.0.0 allows remote attackers to cause a denial of service via a crafted brace pattern. The vulnerability is publicly known with a proof of concept, but exploitation is difficult due to high attack complexity and low EPSS score (0.03%). No active exploitation in the wild has been reported.
Technical ContextAI
The vulnerability is a ReDoS (Regular Expression Denial of Service) in the expand function of index.js in the brace-expansion npm package. The CWE-400 (Uncontrolled Resource Consumption) root cause is a regex that can exhibit catastrophic backtracking when processing specially crafted input with many commas. The affected regex is m.post.match(/,.*\}/) which is replaced with m.post.match(/,(?!,).*\}/) in the fix. The package is widely used as a dependency in many JavaScript projects, including npm itself.
RemediationAI
Upgrade brace-expansion to version 1.1.12, 2.0.2, 3.0.1, or 4.0.1, depending on the major version in use. The patch commit is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. For Debian and Ubuntu systems, apply the respective security updates. No workarounds are available; the only mitigation is to update the package.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | released | 2.0.1+~1.1.0-2 |
| plucky | ignored | end of life, was needs-triage |
| oracular | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1107695| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 2.0.0-1 | - |
| bookworm | vulnerable | 2.0.1-2 | - |
| forky, sid, trixie | fixed | 2.0.1+~1.1.0-2 | - |
| (unstable) | fixed | 2.0.1+~1.1.0-2 | - |
Share
External POC / Exploit Code
Leaving vuln.today