9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25547

CVE-2026-25547: Uncontrolled Resource Consumption in @isaacs/brace-expansion

@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25547

CVE-2026-25547:

9.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@isaacs/brace-expansion	npm	<= 5.0.0	5.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Denial of Service (DoS) in @isaacs/brace-expansion version 5.0.0 and older. The root cause is the unbounded, synchronous, and eager expansion of brace patterns. An attacker can provide a small string with repeated numeric ranges, which causes the library to attempt to generate an exponentially large set of combinations, leading to excessive CPU and memory usage and crashing the Node.js process.

The security patch was released in version 5.0.1. Analysis of the commit history between the vulnerable version 5.0.0 and the patched version 5.0.1 revealed the fixing commit 59d12f1e23accdec8c395ca824cf942c1fdea860.

The patch addresses the vulnerability by introducing a limit on the number of expansions. The following functions were modified:

expand(str, [options]): This is the main, public-facing function. It was modified to accept an options object, which can contain a max property to limit the number of expansions. By default, this limit is set to 100,000. This function serves as the entry point for the vulnerable operation.
expand_(str, max, isTop): This is the internal, recursive function that performs the expansion. It was modified to accept and enforce the max limit during its execution. The loops and recursive calls within this function now check against the max limit to terminate the expansion process early if the limit is reached.

When the vulnerability is triggered, a runtime profiler would show a call to expand, followed by a large number of recursive calls to expand_, which is where the resource exhaustion occurs. Therefore, both functions are key indicators of this vulnerability.

Vulnerable functions

expand

src/index.ts

This is the main exported function and the entry point for the brace expansion. It was vulnerable because it initiated an unbounded recursive expansion process by calling the internal `expand_` function. The patch introduces an `options` object with a `max` limit to control the number of expansions.

expand_

src/index.ts

This is the internal, recursive function that performs the actual brace expansion. The vulnerability is caused by this function's unbounded recursion and iteration, which consumes excessive CPU and memory. The patch introduces a `max` limit, passed from the `expand` function, and checks this limit within its loops to prevent the denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.