AIKIDO-2026-872981
brace-expansion is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
brace-expansionTL;DR
The expand() function limits the size of the accumulator where results are combined but leaves the intermediate arrays built before that step unbounded. Comma alternatives are concatenated into one array with no cumulative result or character limit, and padded numeric sequence generation ignores the length limit while materializing wide elements. A small crafted string passed to expand(), directly or through a glob or brace-pattern matching library, exhausts process memory with an uncatchable out-of-memory crash or blocks the event loop for minutes. The fix bounds both intermediate arrays as they are built and truncates output once the result count or character limits are reached.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass user-controlled input to expand(), directly or transitively through a glob or brace-pattern matching library.
Background info
brace-expansion is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.1.17, 2.0.0 - 2.1.3, 3.0.0 - 3.0.5 and 4.0.0 - 5.0.8.
How to fix this
Upgrade the brace-expansion library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant