Brace Expansion
Monthly
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.
Denial of service in the npm brace-expansion library through version 5.0.6 allows unauthenticated remote attackers to cause exponential CPU consumption by passing a crafted string with consecutive non-expanding brace groups. A public exploit code exists, and patches are available from the vendor, though no active exploitation has been confirmed.
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.
Denial of service in the npm brace-expansion library through version 5.0.6 allows unauthenticated remote attackers to cause exponential CPU consumption by passing a crafted string with consecutive non-expanding brace groups. A public exploit code exists, and patches are available from the vendor, though no active exploitation has been confirmed.
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.