AIKIDO-2026-10477
brace-expansion is vulnerable to Denial of Service (DoS)
65
Medium Risk
This Affects:
brace-expansionTL;DR
The library expands brace patterns synchronously and materializes every combination. Certain attacker-controlled patterns with repeated numeric ranges can make the number of expansions grow exponentially, driving high CPU use and memory pressure until the process fails. Earlier major lines had no supported way to cap how many expansions are produced. The fix threads an optional max limit through the recursive expansion path so callers can bound work.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
brace-expansion is vulnerable to Denial of Service (DoS) in versions 1.0.0 - 1.1.13 and 2.0.0 - 2.0.3.
How to fix this
Upgrade the brace-expansion library to the patch version.
Links
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant