Executive brief
brace-expansion is a popular npm package that parses and expands bash-like brace patterns in strings. A malicious or malformed input pattern with a zero step value (e.g., {1..2..0}) causes the sequence generation loop to run indefinitely, consuming massive amounts of memory and hanging the process for seconds. Any application accepting user-supplied patterns—including tools built on glob/minimatch—could be exploited with just 10 bytes of input.
Technical details
The vulnerability is an infinite loop in the sequence generation logic of brace-expansion. When a brace pattern specifies a zero step increment, the loop variable is incremented by Math.abs(0) = 0, causing it never to advance and the loop condition to never become false. The vulnerable code is in src/index.ts at line 184. The process hangs for 3-4 seconds and allocates ~1.9 GB of memory before eventually throwing a RangeError. The attack vector is network-adjacent (any code path accepting untrusted string input to the expand() function), with no authentication or privilege requirements. Fixed in versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 by sanitizing zero step values to 1, matching bash behavior.
Affected products
- npm brace-expansion >=5.0.0 <5.0.5, >=3.0.0 <3.0.2, >=2.0.0 <2.0.3, >=0.0.0 <1.1.13
Timeline
- 2026-03-26: disclosed
- 2026-03-26: patched: Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 released