The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejsUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemon | Apr 16, 2026 | Apr 8, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-libs-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs22Upgrade nodejs24-develUpgrade nodejs24Upgrade nodejs24-debuginfoUpgrade nodejs24-libsUpgrade nodejs22-npmUpgrade nodejs22-docsUpgrade nodejs24-debugsourceUpgrade v8-13.6-develUpgrade nodejs22-libsUpgrade nodejs24-docsUpgrade nodejs24-npmUpgrade nodejs22-debuginfoUpgrade nodejs22-develUpgrade nodejs22-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade v8-12.4-devel | May 4, 2026 | Feb 4, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Apr 22, 2026 | Apr 21, 2026 |
| Oracle_linux | — | Upgrade v8-13.6-develUpgrade nodejs24-npmUpgrade nodejs-docsUpgrade nodejs24-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs24-docsUpgrade nodejs-nodemonUpgrade nodejs24-libsUpgrade nodejs-npmUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs24-full-i18nUpgrade nodejs | Apr 22, 2026 | Feb 4, 2026 |
| Redhat_linux | — | Upgrade nodejs24-full-i18nUpgrade nodejs24-docsUpgrade nodejs-full-i18nUpgrade nodejs24-libs-debuginfoUpgrade nodejsUpgrade nodejs-packaging-bundlerUpgrade nodejs22-debugsourceUpgrade nodejs24-libsUpgrade nodejs24-debuginfoUpgrade nodejs-libsUpgrade npmUpgrade nodejs24-develUpgrade nodejs24-npmUpgrade nodejs24Upgrade v8-13.6-develUpgrade nodejs24-debugsourceUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs22-debuginfoUpgrade nodejs-packagingUpgrade v8-12.4-develUpgrade nodejs-libs-debuginfoUpgrade nodejs-npmNo solution exists | Apr 9, 2026 | Feb 4, 2026 |
| Rocky_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs24-libs-debuginfoUpgrade nodejs24-libsUpgrade nodejs-debuginfoUpgrade nodejsUpgrade npmUpgrade nodejs24-debuginfoUpgrade nodejs22-debugsourceUpgrade nodejs24-full-i18nUpgrade nodejs24-develUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-full-i18nUpgrade nodejs24Upgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs24-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-npm | Apr 13, 2026 | Apr 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub