CVE-2026-33750: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.

CVE-2026-33750 · Severity: medium · CVSS 6.5 · Published 2026-03-27

brace-expansion is a popular npm package that parses and expands bash-like brace patterns in strings. A malicious or malformed input pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, consuming massive amounts of memory and hanging the process for seconds. Any application accepting user-supplied patterns—including tools built on glob/minimatch—could be exploited with just 10 bytes of input.

Technologies: Juliangruber Brace-Expansion, brace-expansion (npm). Vendors: Juliangruber, npm.

Quick answers

Is CVE-2026-33750 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33750 being exploited in the wild.
How severe is CVE-2026-33750?
Medium severity, with a CVSS score of 6.5, published 27 March 2026.
Which products and versions are affected?
brace-expansion (npm) >=5.0.0 <5.0.5, >=3.0.0 <3.0.2, >=2.0.0 <2.0.3, >=0.0.0 <1.1.13.
Is there a fix for CVE-2026-33750?
A patch was published on 2026-03-26: Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33750 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33750?
Check whether you run Juliangruber Brace-Expansion or brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an infinite loop in the sequence generation logic of brace-expansion. When a brace pattern specifies a zero step increment, the loop variable is incremented by Math.abs(0) = 0, causing it never to advance and the loop condition to never become false. The vulnerable code is in src/index.ts at line 184. The process hangs for 3-4 seconds and allocates ~1.9 GB of memory before eventually throwing a RangeError. The attack vector is network-adjacent (any code path accepting untrusted string input to the expand() function), with no authentication or privilege requirements. Fixed in versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 by sanitizing zero step values to 1, matching bash behavior.

Affected products

  • npm brace-expansion >=5.0.0 <5.0.5, >=3.0.0 <3.0.2, >=2.0.0 <2.0.3, >=0.0.0 <1.1.13

Identifiers

  • CVE-2026-33750
  • GHSA-f886-m6hf-6m8v

Timeline

  • 2026-03-26: disclosed
  • 2026-03-26: patched: Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.