CVE-2026-25547

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

Database specific

{
    "cwe_ids": [
        "CWE-1333"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25547.json"
}

References

Affected packages

Git / github.com/isaacs/brace-expansion

Affected ranges

Type

GIT

Repo

https://github.com/isaacs/brace-expansion

Events

Introduced

Fixed

dc20357ee74ab18df00d596573764428ede66b3d

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.1"
        }
    ]
}

Affected versions

v1.*

v1.0.0

v1.0.1

v5.*

v5.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25547.json"