AIKIDO-2026-312946
brace-expansion is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
brace-expansionTL;DR
The expand() function caps the number of results it produces but does not bound the total length of those results, so chaining many brace groups makes each result grow until process memory is exhausted. A small crafted input can trigger an uncatchable out-of-memory crash, and deeply chained groups can also overflow the call stack. The fix introduces an EXPANSION_MAX_LENGTH limit configurable through a maxLength option that bounds cumulative expansion output and expands the tail iteratively instead of recursing per brace group.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
brace-expansion is vulnerable to Uncontrolled Resource Consumption in versions 0.0.1 - 5.0.7.
How to fix this
Upgrade the org.mvnpm:brace-expansion library to the patch version.
Links
Other
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.