Executive brief
The brace-expansion library, a popular tool for expanding shell-like brace patterns in Node.js, is vulnerable to a denial-of-service attack. An attacker can provide a specially crafted, small string that causes the application to consume all available memory and crash. This crash is uncatchable and will take down the entire application process, leading to a service outage.
Technical details
The `expand()` function in `brace-expansion` versions up to 5.0.7 fails to limit the total length of expanded strings, even though it limits the number of results. By chaining many brace groups (e.g., `'{a,b}'.repeat(1500)`), an attacker can force the library to create a massive number of intermediate 'cons-strings' (ropes) in the V8 engine. This leads to a fatal, uncatchable out-of-memory (OOM) error that terminates the Node.js process. The vulnerability can be triggered remotely if the application passes untrusted input to `expand()` or transitively via libraries like `minimatch` or `glob`. A fix is available in version 5.0.8 which introduces a `maxLength` option to bound total expansion size.
Affected products
- juliangruber brace-expansion <= 5.0.7
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory: NVD publication date
- 2026-07-24: patched: GitHub Advisory reviewed and updated