Uncontrolled Resource Consumption in @isaacs/brace-expansion
Priority MEDIUM 46CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 5 fixed, 29 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00538 45th percentileScored 2026-11-07
Fix Partial brace-expansion (isaacs): 5.0.1@isaacs/brace-expansion (npm): 5.0.1Red Hat: 7 advisoriesRed Hat: 5 fixed, 29 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| isaacs | brace-expansion | before 5.0.1 | 5.0.1 | Patch available | CNA |
| — | @isaacs/brace-expansion (npm) | before 5.0.1 | 5.0.1 | Patch available | GHSA-7h2j-956f-4vf2 |
- brace-expansion Vendorisaacs Affected before 5.0.1 Fixed in 5.0.1 Patch available CNA
- @isaacs/brace-expansion (npm) Vendor— Affected before 5.0.1 Fixed in 5.0.1 Patch available GHSA-7h2j-956f-4vf2
Remediation
- Fix · CNA brace-expansion (isaacs) Fixed in 5.0.1
- Fix · GHSA-7h2j-956f-4vf2 @isaacs/brace-expansion (npm) Fixed in 5.0.1 Advisory →
Red Hat 7 advisories
- RHSA-2026:7983 Released 2026-04-14 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.6.0+24196+39669d4e.s390x::nodejs:22 +28
- RHSA-2026:7675 Released 2026-04-13 · Red Hat rating Importantnodejs24 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.14.1-2.el10_1, nodejs24-devel-1:24.14.1-2.el10_1, nodejs24-docs-1:24.14.1-2.el10_1 +3
- RHSA-2026:7350 Released 2026-04-09 · Red Hat rating Importantnodejs:24 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.aarch64::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.ppc64le::nodejs:24, nodejs-1:24.14.1-2.module+el9.7.0+24166+51c9666b.s390x::nodejs:24 +25
Show 4 more Red Hat advisories
- RHSA-2026:7310 Released 2026-04-09 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.22.2-2.el10_0, nodejs-devel-1:22.22.2-2.el10_0, nodejs-docs-1:22.22.2-2.el10_0 +4
- RHSA-2026:7302 Released 2026-04-09 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el9.7.0+24157+8ddb2461.s390x::nodejs:22 +28
- RHSA-2026:7123 Released 2026-04-08 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.aarch64::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.ppc64le::nodejs:22, nodejs-1:22.22.2-1.module+el8.10.0+24148+847b6786.s390x::nodejs:22 +28
- RHSA-2026:7080 Released 2026-04-08 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.22.2-1.el10_1, nodejs-devel-1:22.22.2-1.el10_1, nodejs-docs-1:22.22.2-1.el10_1 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:7080, RHSA-2026:7675 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:7123 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:7302, RHSA-2026:7350 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:7310 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:7983 |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-25547
- 2026-10-03 Alias added: GHSA-7h2j-956f-4vf2
References
More isaacs vulnerabilities
- TI-2026-42687 node-tar: Decompression/parse DoS via unlimited input CVSS 4.0CRITICAL 9.2
- TI-2026-42688 node-tar: Negative tar entry size causes infinite loop in archive replace CVSS 4.0HIGH 8.7
- TI-2026-51656 Uncontrolled resource consumption in isaacs node-tar CVSS 3.1HIGH 7.5
- TI-2026-42686 node-tar: Process crash via PAX numeric path type confusion CVSS 3.1HIGH 7.5
- TI-2026-24357 node-tar Symlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
- TI-2026-23372 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath CVSS 4.0HIGH 8.2
Sources
- CVE-2026-25547 · CVE Program
- CVE-2026-25547 · NVD
- FIRST EPSS
- GHSA-7h2j-956f-4vf2 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-25547 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences