Executive brief
brace-expansion is a Node.js library that expands brace patterns in strings (e.g., converting `{a,b}` to multiple outputs). A regular expression in the library contains an inefficient pattern that can be exploited with specially crafted input to cause excessive CPU consumption, slowing or halting the application that uses it.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in the brace-expansion library. The root cause is an inefficient regex pattern used during brace expansion parsing that exhibits catastrophic backtracking when provided with malformed input strings containing specific combinations of braces and commas. An attacker can send a crafted string to any application using this library to trigger excessive regex processing, consuming CPU and potentially causing denial of service. The vulnerability requires network reachability to the application and the ability to provide input to the expansion function. A patch has been merged into the main branch addressing the regex inefficiency (commit a5b98a4f30d7813266b221435e1eaaf25a1b0ac5).
Affected products
- Julian Gruber brace-expansion <UNKNOWN>
Timeline
- 2025-06-09: disclosed
- 2025-06-11: patched: Patch merged into main branch via PR #65