REDHAT-BUG-2506433: High severity npm/brace-expansion vulnerability
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 5.0.8 - Configuration
When calling brace-expansion.expand() (including via minimatch/glob brace patterns), set the maxLength option to limit accumulated output and intermediate arrays to prevent fatal out-of-memory crashes (default in 5.0.8 is 4,000,000).
brace-expansion.expand() maxLength = 4000000
Event History
Frequently Asked Questions
Which applications are realistically exposed to this denial-of-service issue?
Applications are exposed if they pass attacker-influenced strings to brace-expansion.expand(), either directly or through minimatch or glob brace-pattern processing. An attacker can crash such a process with a small crafted input.
Is the default configuration affected?
Yes. The default max option limits result count to 100,000 but does not limit the length of individual expanded strings, allowing memory exhaustion even while the result count remains below the default limit.
What input is needed to trigger the issue?
An attacker needs control over a string processed as a brace-expansion pattern. Chaining brace groups, such as repeating "{a,b}" many times, keeps the expansion count within the limit while increasing output-string size until the Node.js process runs out of memory.
What remediation is available?
brace-expansion 5.0.8 adds a maxLength option, defaulting to 4,000,000, to bound accumulated output and intermediate arrays. Updating to that version or later addresses the missing output-length limit.