Description
@isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously.
Recommendation
Update the @isaacs/brace-expansion package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.0.0
- Patched version(s): 5.0.1
References
Could your website be exposed too?
SmartScanner can check your website for @isaacs/brace-expansion has Uncontrolled Resource Consumption and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue - CVE-2026-8769
- DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption - CVE-2026-10691
- Uncontrolled Resource Consumption in ansi-html - CVE-2021-23424
- graphql Uncontrolled Resource Consumption vulnerability - CVE-2023-26144
You might also like:
See something that needs correcting? Let us knowUpdated February 05, 2026