Summary

expand() bounds the number of results it produces (the max option, 100_000 by default) but not their length. By chaining many brace groups, an attacker keeps the result count under max while making every result grow with the number of groups. Building max long results — plus the intermediate arrays combined at each brace group — exhausts memory and crashes the Node process with an uncatchable out-of-memory error. try/catch around expand() does not help: the fatal error terminates the process.

A ~7.5 KB input ('{a,b}'.repeat(1500)) is enough to crash a default Node process.

Details

For N chained brace groups such as '{a,b}'.repeat(N):

• the result count is 2^N, immediately capped at max (100_000), so the max protection appears to hold, but
• each result is N characters long, so the total output size is max × N characters, which grows without bound in N.

expand_ combines each brace set with the fully-expanded tail:

const post = m.post.length ? expand_(m.post, max, false) : ['']
...
for (let j = 0; j < N.length; j++) {
  for (let k = 0; k < post.length && expansions.length < max; k++) {
    const expansion = pre + N[j] + post[k]   // grows one group longer per level
    ...
    expansions.push(expansion)
  }
}

The loop guard expansions.length < max limits how many strings are built, but nothing limits how long they get. Each recursion level materializes another array of up to max strings, one character longer than the level below, and — because V8 represents pre + N[j] + post[k] as a cons-string (rope) that references post[k] — those intermediate strings stay reachable through the whole chain. Memory therefore scales with max × N.

Measured on 5.0.7 ('{a,b}'.repeat(N), default max):

Proof of concept

const { expand } = require('brace-expansion')

// ~7.5 KB input — crashes the process with a fatal, uncatchable OOM:
//   FATAL ERROR: ... JavaScript heap out of memory
try {
  expand('{a,b}'.repeat(1500))
} catch (e) {
  // never reached — the process is already dead
}

Impact

Any application that passes attacker-influenced strings to brace-expansion.expand() — directly, or transitively via minimatch / glob brace patterns — can be crashed by a small request. Because the failure is a fatal V8 out-of-memory error rather than a thrown exception, it cannot be caught and it takes down the whole worker/process, denying service.

Remediation

Upgrade to a patched release. The fix bounds the total number of characters a single expand() call may accumulate (EXPANSION_MAX_LENGTH, default 4_000_000, configurable via a new maxLength option), applied inside the output-building loops so intermediate arrays are bounded too. Once the limit is reached, output is truncated — consistent with how max already truncates — instead of growing without bound. The limit sits well above any realistic expansion (100,000 results hitting max measure ~1M characters), so legitimate input is unaffected.

After the fix, '{a,b}'.repeat(1500) returns a bounded, truncated result in ~0.7 s using ~340 MB and never crashes, including under a constrained 512 MB heap.

The fix bounds memory but the algorithm still rebuilds intermediate arrays at each level (roughly O(N × maxLength) work on this input class). A streaming rewrite that produces output in O(total output size) can be a non-urgent follow-up.

If immediate upgrade isn't possible, avoid passing untrusted input to expand() / glob brace patterns, or pass a small explicit max and maxLength.

Multiple versions of the Node.js minimist module contain a prototype pollution vulnerability in the setKey() function, enabling remote code execution and uncontrolled resource consumption, affecting various products including NetApp and several Node.js updates.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the minimatch package's braceExpand function, affecting multiple dependent products including Catboost, Dash-extensions, and Jnitrace, which have updated to minimatch version 3.1.2 to address the issue.

Babel versions prior to 7.23.2 and related plugins are vulnerable to arbitrary code execution via the internal methods path.evaluate() and path.evaluateTruthy() when compiling attacker-crafted code.

A vulnerability in the BC-JAVA library's GOST 28147-2015 CTR mode causes keystream reuse after 255 blocks, affecting multiple versions and IBM Db2 Server, enabling attackers to compromise data confidentiality.

A second-order SQL injection vulnerability in Hibernate ORM versions 5.2.8 to 5.6.15, affecting Red Hat and NetApp products, allows remote attackers with low privileges to exploit unsanitized non-alphanumeric characters, risking data disclosure and manipulation.

Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can bypass security controls and lead to cache poisoning, access control bypass, and session hijacking.

A resource allocation vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg before version 1.84 allows unauthenticated attackers to cause memory exhaustion and denial of service via unbounded PGP AEAD chunk sizes.

Multiple lodash vulnerabilities, including CVE-2021-23337 and command injection in _.template, affect various versions and Oracle products, enabling code injection and remote takeover with severity up to CVSS 9.8, fixed in lodash 4.18.0 and later.

fast-uri versions 3.1.0 and earlier improperly decode percent-encoded path separators and dot segments before normalization, causing distinct URIs to collapse into the same path and enabling bypass of path-based security policies.

fast-uri versions up to 3.1.1 improperly decode percent-encoded authority delimiters in the host component, altering URI structure and enabling redirection to unintended hosts.

Eclipse Jetty's DigestAuthentication improperly uses ISO-8859-1 encoding for password hashing, causing non-Latin-1 characters to be replaced with '?', enabling attackers to bypass authentication via hash collisions and impersonation.

The form-data library up to version 4.0.5 is vulnerable to CRLF injection due to unescaped carriage return, line feed, and double-quote characters in multipart field names and filenames, fixed in versions 2.5.6, 3.0.5, and 4.0.6 by escaping these characters.

Multiple Node.js updates address a denial of service vulnerability in the undici WebSocket client caused by unbounded memory growth from numerous small or empty continuation frames, alongside other critical security fixes.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability in CMS AuthEnvelopedData where tag-length enforcement fails during decryption, potentially compromising data integrity.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 contain a vulnerability in KCCMBlockCipher MAC where nonce binding fails without AAD, enabling cross-nonce AEAD forgery attacks.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 are vulnerable to IESEngine stream-mode MAC forgery due to a length-dependent key derivation function split issue.

brace-expansion versions through 5.0.6 have a denial of service vulnerability due to the expand() function's exponential-time complexity when processing consecutive non-expanding brace groups, causing high CPU usage and event-loop blocking.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where lazy ASN.1 sequence forcing resets the nesting-depth guard, potentially compromising security controls.

fast-uri versions 2.3.1 through 4.0.0 fail to properly canonicalize Unicode/IDN hostnames in HTTP URLs, causing discrepancies with Node's URL parser that can be exploited to bypass host-based security policies.

brace-expansion versions through 5.0.7 contain a denial of service vulnerability due to unbounded string length in the expand() function, leading to memory exhaustion and fixed in version 5.0.8 by adding a maxLength limit.

Bouncy Castle for Java versions prior to 1.85, including certain LTS, FIPS, and bctls-fips versions, contains a vulnerability that can cause out-of-memory errors due to unbounded memory allocation during definite-length reads.

fast-uri versions 2.3.1 to 4.1.0 improperly handle backslashes in URLs, causing host parsing inconsistencies with Node's WHATWG URL parser that can lead to security bypasses, requiring upgrades to fixed versions.

fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4 improperly parse URIs with backslashes instead of double forward slashes, causing discrepancies with Node's WHATWG URL parser and enabling host-based security policy bypasses.

A critical Broken Authentication & Session Management vulnerability (CVE-2026-21582) in Atlassian Crowd Data Center 7.2.1 enables unauthenticated attackers to impersonate other users.

Multiple Apache Tomcat and Apache Tomcat Native versions contain an improper input validation vulnerability in OCSP response handling that allows bypassing certificate revocation checks, with additional critical flaws affecting related products like Oracle Siebel CRM and SAP Commerce Cloud.

Multiple vulnerabilities in axios versions prior to 0.30.3 and 1.13.5 cause denial of service via mergeConfig crashing on configuration objects containing __proto__, alongside various security issues in HPE and Oracle products.

Underscore.js versions up to 1.13.7 and Oracle Commerce Platform 11.4.0 contain vulnerabilities causing denial of service via stack overflow or application hang through recursive data processing or business control center flaws, while HPE UOCAM suffers from multiple security issues including path traversal and resource overconsumption.

Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a high-severity arbitrary file write vulnerability via path traversal due to improper filename sanitization, enabling attackers to overwrite files and potentially execute remote code.

Node-tar versions prior to 7.5.10 contain a vulnerability allowing crafted archives to create hardlinks with drive-relative link targets on Windows, enabling path traversal and file overwrite outside the extraction directory.

Micrometer versions 1.15.0 to 1.15.11 and 1.16.0 to 1.16.5 contain a vulnerability where specially crafted gRPC requests can trigger a denial-of-service (DoS) condition, impacting system availability.

Micrometer versions 1.9.0 through 1.16.5, including micrometer-core and micrometer-jetty, are vulnerable to specially crafted HTTP requests that can cause a denial-of-service (DoS) condition, impacting system availability.

Apache Tomcat versions 9.0.0.M1 to 11.0.21 have multiple vulnerabilities including unbounded WebDAV request bodies, HTTP/2 header validation flaws, WebSocket authentication exposure, and authorization bypass, leading to denial of service, crashes, and credential exposure.

Spring Framework versions used in Spring MVC and WebFlux applications are vulnerable to DoS attacks during static resource resolution, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a remotely exploitable vulnerability allowing system takeover, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications products, including a JavaScript escaping flaw enabling XSS, a difficult-to-exploit remote takeover in BRM Elastic Charging Engine, and a non-exploitable security-in-depth issue in Management Cloud Engine.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0, including an Algorithmic DoS and a difficult-to-exploit remote takeover vulnerability.

Certain Spring Framework versions are vulnerable to DoS via unbounded cache growth from user-supplied SpEL expressions, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a difficult-to-exploit unauthenticated HTTP takeover vulnerability, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

The uuid library versions prior to 14.0.0 have a vulnerability in v3, v5, and v6 UUID functions where missing buffer bounds checks allow silent partial or out-of-range writes to caller-provided buffers, potentially causing malformed UUIDs.

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution attacks that enable attackers to intercept, modify JSON responses, or hijack HTTP requests and responses via polluted configuration properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests by exploiting polluted Object.prototype properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a high-severity Prototype Pollution vulnerability in the validateStatus property merge strategy that allows attackers to bypass authentication and error handling by treating all HTTP error responses as successful.

pgjdbc versions 42.2.0 to before 42.7.11 are vulnerable to client-side denial of service via excessive CPU usage during SCRAM-SHA-256 authentication, fixed in 42.7.11, while Oracle Communications Cloud Native Core Console versions 25.1.203 and 25.2.201 have a network-accessible SQL injection denial of service vulnerability.

Multiple vulnerabilities in Apache Netty prior to versions 4.1.133.Final and 4.2.13.Final allow remote attackers to cause excessive memory allocation, denial of service, and potential data compromise via crafted LZ4 compressed data and HTTP/2 requests.

Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstandard, and Snappy encodings, causing out-of-memory denial of service.

Apache Tomcat versions 7.0.0 to 11.0.21 contain multiple security vulnerabilities including LockOutRealm case sensitivity issues, digest authentication bypass, WebDAV request size DoS, HTTP/2 header validation flaws, WebSocket authentication exposure, and AJP secret comparison weaknesses.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain an IPv6 subnet bypass vulnerability in IpSubnetFilterRule.compareTo() due to incorrect masking, allowing unauthorized access control bypass.

Axios Node.js HTTP adapter versions prior to 0.32.0 and 1.16.0 can leak proxy credentials via stale Proxy-Authorization headers when following redirects from proxied to non-proxied targets, exposing sensitive authentication data.

Axios versions prior to 0.32.0 and 1.16.0 have a vulnerability in the Node.js HTTP adapter where Proxy-Authorization headers may be forwarded to redirected origins during proxy-to-direct redirect flows, risking exposure of sensitive proxy credentials.

Axios versions 1.7.0 through 1.15.x failed to enforce configured request and response size limits when using the fetch adapter, allowing oversized bodies that can cause resource exhaustion in server-side applications.

Axios versions prior to 1.16.0, including 1.15.2 and earlier, are vulnerable to prototype pollution that enables arbitrary HTTP header injection, sensitive data leakage, and denial-of-service crashes due to unsafe merging of object properties.

Axios versions prior to 0.32.0 and 1.16.0 contain a vulnerability where IPv4-mapped IPv6 addresses are not normalized in the shouldBypassProxy function, allowing NO_PROXY restrictions to be bypassed and requests to be routed through proxies improperly.

Axios versions 1.0.0 to before 1.16.0 contain a Prototype Pollution gadget in `config.proxy` that escalates Object.prototype pollution into a full Man-in-the-Middle attack, enabling interception and modification of all HTTP traffic including credentials.

Axios versions prior to 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request config processing that can be exploited via a polluted Object.prototype.transformResponse from another vulnerability, enabling credential theft, response hijacking, or denial-of-service.

Axios versions before 0.32.0 and 1.16.0 have a vulnerability where unescaped regex metacharacters in the XSRF cookie name cause excessive regex backtracking, leading to client-side denial of service by freezing the browser tab.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a critical vulnerability in SslClientHelloHandler.decode() that causes unbounded memory allocation from crafted TLS ClientHello messages, leading to potential denial of service.

PostCSS versions up to 8.5.11 contain a vulnerability where attacker-controlled sourceMappingURL comments in CSS enable arbitrary local file reads, partial content disclosure, file-existence oracle, and potential denial of service.

The js-cookie library's assign() function was vulnerable to prototype pollution via JSON objects containing a __proto__ property, allowing attackers to manipulate cookie attributes such as domain, secure, and samesite.

Spring Security versions 5.7.0 to 5.7.24, 5.8.0 to 5.8.26, 6.3.0 to 6.3.17, 6.4.0 to 6.4.17, and 6.5.0 to 6.5.10 contain a vulnerability in the deprecated SubjectDnX509PrincipalExtractor that improperly handles malformed X.509 certificate CN values, enabling potential user impersonation.

A resource leak vulnerability in Netty's DelegatingDecompressorFrameListener class for HTTP/2 decompression can cause JVM Out Of Memory Errors and Denial of Service, fixed in netty-codec-http2 versions 4.1.135.Final and 4.2.15.Final.