@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
The library processes patterns containing numeric ranges in curly braces, synchronously generating all possible combinations. When an attacker provides a pattern with deeply nested or repeating numeric ranges, the number of combinations grows exponentially. Due to the lack of restrictions on expansion depth or size (CWE-1333 — Improper Neutralization of Special Elements via ReDoS-like mechanism), the process becomes blocked on computations, exhausting system resources. No authentication or user interaction is required, and the attack is possible remotely.
An attacker can cause complete unavailability of a Node.js-based application through process crash or suspension due to CPU and memory exhaustion. The consequences include both the unavailability of the application itself and the systems that depend on it.
Update the @isaacs/brace-expansion package to version 5.0.1 or newer, where the issue has been fixed. It is also recommended to review all project dependencies using this library and enforce updates at the lock file level.
The @isaacs/brace-expansion package in versions prior to 5.0.1 (CJS/ESM hybrid, a TypeScript-written fork of the brace-expansion library).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X