AIKIDO-2026-967896
brace-expansion is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
brace-expansionTL;DR
The brace-expansion parser can be driven into excessive internal rescans when handling certain crafted brace patterns, consuming CPU time disproportionate to the size of the input before it finishes. Malformed nested or repeated brace sequences can keep the parser looping well past normal use, delaying the event loop on a single call. The fix bounds the parser's internal reprocessing to stop this from growing unchecked.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
brace-expansion is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 1.1.19, 2.0.0 - 2.1.5, 3.0.0 - 3.0.7 and 4.0.0 - 5.0.10.
How to fix this
Upgrade the brace-expansion library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.