# CVE-2025-5889: brace-expansion regular expression denial of service

Source: https://junglewise.ai/threats/cve-2025-5889-brace-expansion-regular-expression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-06-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-5889 · Severity: low · CVSS 3.1 · Published 2025-06-09

brace-expansion is a Node.js library that expands brace patterns in strings (e.g., converting `{a,b}` to multiple outputs). A regular expression in the library contains an inefficient pattern that can be exploited with specially crafted input to cause excessive CPU consumption, slowing or halting the application that uses it.

Technologies: [brace-expansion (npm)](https://junglewise.ai/threats/technologies/brace-expansion). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-5889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5889 being exploited in the wild.

**How severe is CVE-2025-5889?** Low severity, with a CVSS score of 3.1, published 9 June 2025.

**Which products and versions are affected?** brace-expansion (npm) SEMVER:introduced=2.0.0,fixed=2.0.2.

**Is there a fix for CVE-2025-5889?** Yes. brace-expansion (npm): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-5889 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-5889?** Check whether you run brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- brace-expansion (npm): upgrade to 2.0.2 or later

  ```sh
  npm install brace-expansion@2.0.2
  ```


## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in the brace-expansion library. The root cause is an inefficient regex pattern used during brace expansion parsing that exhibits catastrophic backtracking when provided with malformed input strings containing specific combinations of braces and commas. An attacker can send a crafted string to any application using this library to trigger excessive regex processing, consuming CPU and potentially causing denial of service. The vulnerability requires network reachability to the application and the ability to provide input to the expansion function. A patch has been merged into the main branch addressing the regex inefficiency (commit a5b98a4f30d7813266b221435e1eaaf25a1b0ac5).

## Affected products

- Julian Gruber brace-expansion <UNKNOWN>

## Identifiers

- CVE-2025-5889
- GHSA-v6h2-p8h4-qcjw

## Timeline

- 2025-06-09: disclosed
- 2025-06-11: patched: Patch merged into main branch via PR #65

## References

- [https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5](https://github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5)

## Related threats

- [brace-expansion stack exhaustion in deeply nested brace groups](https://junglewise.ai/threats/cve-2026-102278-the-brace-expansion-library-generates-arbitrary-strings)
- [brace-expansion quadratic CPU consumption denial of service](https://junglewise.ai/threats/cve-2026-102277-the-brace-expansion-library-generates-arbitrary-strings)
- [brace-expansion stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-102276-the-brace-expansion-library-generates-arbitrary-strings)
- [juliangruber brace-expansion Denial of Service via unbounded arrays](https://junglewise.ai/threats/cve-2026-69152-juliangruber-brace-expansion-denial-of-service-via-unbounded)
- [juliangruber brace-expansion denial of service via memory exhaustion](https://junglewise.ai/threats/cve-2026-14257-juliangruber-brace-expansion-denial-of-service-via-memory)