@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
CVSS Details
- CVSS 4.0 Base Score: 9.2 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade npm | Apr 16, 2026 | Apr 8, 2026 |
| Amazon_linux_2023 | — | Upgrade v8-13.6-develUpgrade nodejs22-libsUpgrade nodejs24-develUpgrade nodejs24-full-i18nUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs22-npmUpgrade nodejs24-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs22Upgrade nodejs24Upgrade nodejs24-libsUpgrade nodejs22-docsUpgrade nodejs24-npmUpgrade nodejs24-docsUpgrade v8-12.4-develUpgrade nodejs22-full-i18nUpgrade nodejs22-debuginfoUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-devel | May 4, 2026 | Feb 4, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Apr 22, 2026 | Apr 21, 2026 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade nodejs24Upgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade v8-13.6-develUpgrade v8-12.4-develUpgrade nodejsUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-libsUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade nodejs24-libs | Apr 22, 2026 | Feb 4, 2026 |
| Redhat_linux | — | Upgrade v8-13.6-develUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-libs-debuginfoUpgrade nodejs24-debugsourceUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs22-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingNo solution existsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-npmUpgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs24-libsUpgrade nodejs24-npmUpgrade nodejs24-debuginfoUpgrade nodejs-libsUpgrade nodejs22-debugsourceUpgrade npmUpgrade nodejs24-develUpgrade nodejs-full-i18n | Apr 9, 2026 | Feb 4, 2026 |
| Rocky_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs24-debuginfoUpgrade nodejs24-full-i18nUpgrade npmUpgrade nodejs22-debugsourceUpgrade nodejs24-develUpgrade nodejs-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-debuginfoUpgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs-npmUpgrade nodejs-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs24Upgrade nodejs-libs | Apr 13, 2026 | Apr 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub