EUVD-2026-33442
GHSA-jxxr-4gwj-5jf2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible via crafted input; no auth needed; memory exhaustion causes DoS
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionNVD
The max option was being applied too late:
When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array.
Workaround
Ensure the string to be expanded doesn't contain more values than the desired max item count.
AnalysisAI
Denial of service in brace-expansion versions 5.0.0 through 5.0.5 allows remote attackers to cause excessive resource consumption. When an application passes untrusted input to the expand function with a numeric max limit, a crafted string containing a single large numeric range (e.g., {1..10000000}) triggers allocation of a massive intermediate array before the limit is applied, leading to memory exhaustion and service disruption. No active exploitation has been reported, and the low EPSS score (0.03%) indicates a low probability of widespread attacks.
Technical ContextAI
brace-expansion is an npm library that implements brace expansion (like {1..5} → 1 2 3 4 5) commonly used in shells and build tools. The root cause is CWE-400 Uncontrolled Resource Consumption: the sequence generation loop allocates all intermediate elements regardless of the max option, only capping the output array at the end. The affected code is in the expand_ function in src/index.ts. The package is identified by CPE pkg:npm/brace-expansion.
RemediationAI
Upgrade to brace-expansion version 5.0.6 or later, available via npm (npm update brace-expansion@5.0.6). The patch commit (https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5) adds the max check inside the expansion loop, preventing excessive allocations. As a temporary workaround, sanitise user input to remove large numeric brace ranges before calling the library, or restrict the maximum range size at the application level. Note that this workaround may break legitimate brace expansion patterns; thorough input validation is required.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today