Executive brief
@isaacs/brace-expansion is a JavaScript library that expands shell-style brace patterns (e.g. {a,b,c}). The vulnerability allows an attacker to cause denial of service by providing a specially crafted pattern with repeated numeric ranges that generates billions of combinations, exhausting CPU and memory and crashing Node.js applications that use the library.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-1333) in the brace expansion logic. The library performs eager, synchronous expansion of brace expressions without bounds checking. When a pattern like {0..99}{0..99}{0..99}{0..99}{0..99} is provided, it attempts to generate all 10 billion combinations before returning, overwhelming the event loop and heap. The attack requires no authentication and can be triggered by any unauthenticated caller providing untrusted input to the expand() function. An attacker can reliably crash a Node.js process with a small payload. The vulnerability was patched in version 5.0.1; all versions up to 5.0.0 are affected.
Affected products
- isaacs @isaacs/brace-expansion <=5.0.0
Timeline
- 2026-02-03: disclosed
- 2026-02-03: patched: Version 5.0.1 released