brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Priority LOW 33CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 2 fixed, 49 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00447 39th percentileScored 2026-11-07
Fix Partial brace-expansion (juliangruber): 5.0.5, 3.0.2, 2.0.3 +1brace-expansion (npm): 5.0.5, 3.0.2, 2.0.3 +1Red Hat: 2 advisoriesRed Hat: 2 fixed, 49 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juliangruber | brace-expansion | 4.0.0 to before 5.0.5; 3.0.0 to before 3.0.2; 2.0.0 to before 2.0.3; before 1.1.13 | 5.0.5, 3.0.2, 2.0.3, 1.1.13 | Patch available | CNA |
| — | brace-expansion (npm) | 4.0.0 to before 5.0.5 | 5.0.5 | Patch available | GHSA-f886-m6hf-6m8v |
| — | brace-expansion (npm) | 3.0.0 to before 3.0.2 | 3.0.2 | Patch available | GHSA-f886-m6hf-6m8v |
| — | brace-expansion (npm) | 2.0.0 to before 2.0.3 | 2.0.3 | Patch available | GHSA-f886-m6hf-6m8v |
| — | brace-expansion (npm) | before 1.1.13 | 1.1.13 | Patch available | GHSA-f886-m6hf-6m8v |
- brace-expansion Vendorjuliangruber Affected 4.0.0 to before 5.0.5; 3.0.0 to before 3.0.2; 2.0.0 to before 2.0.3; before 1.1.13 Fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13 Patch available CNA
- brace-expansion (npm) Vendor— Affected 4.0.0 to before 5.0.5 Fixed in 5.0.5 Patch available GHSA-f886-m6hf-6m8v
- brace-expansion (npm) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-f886-m6hf-6m8v
- brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.0.3 Fixed in 2.0.3 Patch available GHSA-f886-m6hf-6m8v
- brace-expansion (npm) Vendor— Affected before 1.1.13 Fixed in 1.1.13 Patch available GHSA-f886-m6hf-6m8v
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:* | before 1.1.13; 2.0.0 to before 2.0.3; 3.0.0 to before 3.0.2; 5.0.0 to before 5.0.5 | Vulnerable | juliangruber |
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:* Versions before 1.1.13; 2.0.0 to before 2.0.3; 3.0.0 to before 3.0.2; 5.0.0 to before 5.0.5 Vulnerable ·juliangruber
Remediation
- Fix · CNA brace-expansion (juliangruber) Fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13
- Fix · GHSA-f886-m6hf-6m8v brace-expansion (npm) Fixed in 5.0.5 Advisory →
- Fix · GHSA-f886-m6hf-6m8v brace-expansion (npm) Fixed in 3.0.2 Advisory →
- Fix · GHSA-f886-m6hf-6m8v brace-expansion (npm) Fixed in 2.0.3 Advisory →
- Fix · GHSA-f886-m6hf-6m8v brace-expansion (npm) Fixed in 1.1.13 Advisory →
Red Hat 2 advisories
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Gatekeeper 3 | Affected | No fix yet: Fix deferred |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix planned: Out of support scope |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix planned: Out of support scope |
| Multicluster Engine for Kubernetes | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix planned: Out of support scope |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 2 | Affected | No fix planned: Out of support scope |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop - Tech Preview | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix planned: Out of support scope |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix planned: Out of support scope |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Out of support scope |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
Not affected: 4 products
- Migration Toolkit for Virtualization
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.22
- Red Hat Trusted Profile Analyzer
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33750
- 2026-10-03 Alias added: GHSA-f886-m6hf-6m8v
- 2026-10-27 Affected versions changed · Red Hat
References
Patch 8
- https://github.com/juliangruber/brace-expansion/pull/95
- https://github.com/juliangruber/brace-expansion/pull/96
- https://github.com/juliangruber/brace-expansion/pull/97
- https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
- https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
- https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
- https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
Advisory 2
More juliangruber Brace-expansion vulnerabilities
- TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
- TI-2026-12072 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash CVSS 3.1HIGH 7.5
- TI-2026-32977 brace-expansion: Large numeric range defeats documented `max` DoS protection CVSS 3.1HIGH 7.5
Sources
- CVE-2026-33750 · CVE Program
- CVE-2026-33750 · NVD
- FIRST EPSS
- GHSA-f886-m6hf-6m8v · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33750 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences