CVE-2026-33750mediumCWE-400

CVE-2026-33750: falha de média gravidade em juliangruber brace-expansion

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Publicada em

Seguir esta CVE+ Monitorar brace-expansion+ Monitorar node-brace-expansion

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
juliangruber · brace-expansion
CVEs relacionadas — juliangruber brace-expansion

No mesmo produto, das mais perigosas para as menos.

CVE-2026-69152HIGHbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationEPSS 0.6%CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2026-102278HIGHbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionEPSS 0.5%CVE-2026-102276HIGHbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionEPSS 0.5%CVE-2026-102277MEDIUMbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceEPSS 0.4%