# CVE-2026-25547: @isaacs/brace-expansion denial of service via exponential expansion

Source: https://junglewise.ai/threats/cve-2026-25547-isaacs-brace-expansion-denial-of-service-via-exponential  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-25547 · Severity: medium · CVSS 4 · Published 2026-02-03

@isaacs/brace-expansion is a JavaScript library that expands shell-style brace patterns (e.g. {a,b,c}). The vulnerability allows an attacker to cause denial of service by providing a specially crafted pattern with repeated numeric ranges that generates billions of combinations, exhausting CPU and memory and crashing Node.js applications that use the library.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-25547 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25547 being exploited in the wild.

**How severe is CVE-2026-25547?** Medium severity, with a CVSS score of 4, published 3 February 2026.

**Which products and versions are affected?** @isaacs/brace-expansion (npm) SEMVER:introduced=0,fixed=5.0.1.

**Is there a fix for CVE-2026-25547?** Yes. @isaacs/brace-expansion (npm): upgrade to 5.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25547 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-25547?** Check whether you run @isaacs/brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @isaacs/brace-expansion (npm): upgrade to 5.0.1 or later

  ```sh
  npm install @isaacs/brace-expansion@5.0.1
  ```


## Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-1333) in the brace expansion logic. The library performs eager, synchronous expansion of brace expressions without bounds checking. When a pattern like {0..99}{0..99}{0..99}{0..99}{0..99} is provided, it attempts to generate all 10 billion combinations before returning, overwhelming the event loop and heap. The attack requires no authentication and can be triggered by any unauthenticated caller providing untrusted input to the expand() function. An attacker can reliably crash a Node.js process with a small payload. The vulnerability was patched in version 5.0.1; all versions up to 5.0.0 are affected.

## Affected products

- isaacs @isaacs/brace-expansion <=5.0.0

## Identifiers

- CVE-2026-25547
- GHSA-7h2j-956f-4vf2

## Timeline

- 2026-02-03: disclosed
- 2026-02-03: patched: Version 5.0.1 released

## References

- [https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2](https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2)