{"id":"CVE-2026-33750","aliases":["AZL-81075","AZL-81084","CLSA-2026-1777250307","CLSA-2026-1781830545","CLSA-2026-1781830551","CLSA-2026-1792233308","CLSA-2026-1792233325","CLSA-2026-1792243228","CLSA-2026-1792508599","CLSA-2026-1793102029","CLSA-2026-1793808088","DEBIAN-CVE-2026-33750","EUVD-2026-16620","GHSA-f886-m6hf-6m8v","OESA-2026-1835","ROOT-APP-NPM-CVE-2026-33750","UBUNTU-CVE-2026-33750"],"status":"published","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00447,"percentile":0.39362,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-03-26T18:29:42Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"npm","package":"brace-expansion","fixed_in":["5.0.5","3.0.2","2.0.3","1.1.13"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"brace-expansion","fixed_in":["1.1.12-tuxcare.2","5.0.4-tuxcare.4","5.0.3-tuxcare.2","5.0.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-brace-expansion","fixed_in":["2.0.3+~1.1.2-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-brace-expansion","fixed_in":["1.1.11-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-brace-expansion","fixed_in":["1.1.11-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nodejs-brace-expansion","fixed_in":["1.1.11-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-brace-expansion","fixed_in":["1.1.11-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-brace-expansion","fixed_in":["1.1.11-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"nodejs-brace-expansion","fixed_in":["1.1.11-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"brace-expansion","fixed_in":["2.0.1-aikido.3","1.1.12-aikido.2","1.1.11-aikido.3","2.0.2-aikido.2","5.0.3-aikido.1","5.0.3-aikido.2","2.0.1-aikido.4","2.0.2-aikido.3","1.1.12-aikido.3","1.1.11-aikido.4","1.1.11-aikido.5","1.1.12-aikido.4","1.1.11-aikido.6","2.0.1-aikido.5","2.0.2-aikido.4","5.0.4-aikido.2","5.0.4-aikido.3","5.0.4-aikido.4","5.0.4-aikido.5","5.0.3-aikido.3","5.0.3-aikido.4","5.0.3-aikido.5","2.0.1-aikido.6","1.1.12-aikido.5","1.1.12-aikido.6","2.0.1-aikido.7","1.1.11-aikido.7","2.0.2-aikido.5","2.0.2-aikido.6","5.0.3-aikido.6","5.0.5-aikido.1","2.0.3-aikido.1","1.1.13-aikido.1","5.0.5-aikido.2","5.0.5-aikido.3","2.0.3-aikido.2","1.1.13-aikido.2","2.0.3-aikido.3","5.0.5-aikido.4","1.1.13-aikido.3","1.1.13-aikido.4","1.1.13-aikido.5","5.0.5-aikido.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/brace-expansion","fixed_in":["1.1.11-root.io.1","2.0.1-root.io.1","2.0.2-root.io.1","1.1.12-root.io.1","2.0.1-root.io.2","1.1.11-root.io.2","2.0.1-root.io.3","1.1.12-root.io.2","1.1.11-root.io.3","2.0.2-root.io.2","5.0.3-root.io.1","5.0.3-root.io.2","2.0.1-root.io.4","2.0.2-root.io.3","1.1.12-root.io.3","1.1.11-root.io.4","1.1.11-root.io.5","1.1.12-root.io.4","1.1.11-root.io.6","2.0.1-root.io.5","2.0.2-root.io.4","5.0.4-root.io.2","5.0.4-root.io.3","5.0.4-root.io.4","5.0.4-root.io.5","5.0.3-root.io.3","5.0.3-root.io.4","5.0.3-root.io.5","2.0.1-root.io.6","1.1.12-root.io.5","1.1.12-root.io.6","2.0.1-root.io.7","1.1.11-root.io.7","2.0.2-root.io.5","2.0.2-root.io.6","5.0.3-root.io.6","5.0.5-root.io.1","2.0.3-root.io.1","1.1.13-root.io.1","5.0.5-root.io.2","5.0.5-root.io.3","2.0.3-root.io.2","1.1.13-root.io.2","2.0.3-root.io.3","5.0.5-root.io.4","1.1.13-root.io.3","1.1.13-root.io.4","1.1.13-root.io.5","5.0.5-root.io.5"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"5.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.3-5"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.12-tuxcare.0"},{"fixed":"1.1.12-tuxcare.2"}]}],"versions":["1.1.12","1.1.12-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.1"}]}],"versions":["2.0.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.11-tuxcare.0"},{"fixed":"1.1.11-tuxcare.1"}]}],"versions":["1.1.11"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.1-tuxcare.0"},{"fixed":"4.0.1-tuxcare.3"}]}],"versions":["4.0.1","4.0.1-tuxcare.1","4.0.1-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.4-tuxcare.0"},{"fixed":"5.0.4-tuxcare.4"}]}],"versions":["5.0.4","5.0.4-tuxcare.1","5.0.4-tuxcare.2","5.0.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.4"}]}],"versions":["2.0.2","2.0.2-tuxcare.1","2.0.2-tuxcare.2","2.0.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.3-tuxcare.0"},{"fixed":"5.0.3-tuxcare.2"}]}],"versions":["5.0.3","5.0.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.3-tuxcare.0"},{"fixed":"1.1.3-tuxcare.2"}]}],"versions":["1.1.3","1.1.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.2-tuxcare.0"},{"fixed":"5.0.2-tuxcare.2"}]}],"versions":["5.0.2","5.0.2-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2","2.0.1-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-1","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1","2.1.7+~1.1.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3+~1.1.2-1"}]}],"versions":["2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"5.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.13"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nodejs-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-aikido.3"},{"fixed":"1.1.12-aikido.2"},{"fixed":"1.1.11-aikido.3"},{"fixed":"2.0.2-aikido.2"},{"fixed":"5.0.3-aikido.1"},{"fixed":"5.0.3-aikido.2"},{"fixed":"2.0.1-aikido.4"},{"fixed":"2.0.2-aikido.3"},{"fixed":"1.1.12-aikido.3"},{"fixed":"1.1.11-aikido.4"},{"fixed":"1.1.11-aikido.5"},{"fixed":"1.1.12-aikido.4"},{"fixed":"1.1.11-aikido.6"},{"fixed":"2.0.1-aikido.5"},{"fixed":"2.0.2-aikido.4"},{"fixed":"5.0.4-aikido.2"},{"fixed":"5.0.4-aikido.3"},{"fixed":"5.0.4-aikido.4"},{"fixed":"5.0.4-aikido.5"},{"fixed":"5.0.3-aikido.3"},{"fixed":"5.0.3-aikido.4"},{"fixed":"5.0.3-aikido.5"},{"fixed":"2.0.1-aikido.6"},{"fixed":"1.1.12-aikido.5"},{"fixed":"1.1.12-aikido.6"},{"fixed":"2.0.1-aikido.7"},{"fixed":"1.1.11-aikido.7"},{"fixed":"2.0.2-aikido.5"},{"fixed":"2.0.2-aikido.6"},{"fixed":"5.0.3-aikido.6"},{"fixed":"5.0.5-aikido.1"},{"fixed":"2.0.3-aikido.1"},{"fixed":"1.1.13-aikido.1"},{"fixed":"5.0.5-aikido.2"},{"fixed":"5.0.5-aikido.3"},{"fixed":"2.0.3-aikido.2"},{"fixed":"1.1.13-aikido.2"},{"fixed":"2.0.3-aikido.3"},{"fixed":"5.0.5-aikido.4"},{"fixed":"1.1.13-aikido.3"},{"fixed":"1.1.13-aikido.4"},{"fixed":"1.1.13-aikido.5"},{"fixed":"5.0.5-aikido.5"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.11-root.io.1"},{"fixed":"2.0.1-root.io.1"},{"fixed":"2.0.2-root.io.1"},{"fixed":"1.1.12-root.io.1"},{"fixed":"2.0.1-root.io.2"},{"fixed":"1.1.11-root.io.2"},{"fixed":"2.0.1-root.io.3"},{"fixed":"1.1.12-root.io.2"},{"fixed":"1.1.11-root.io.3"},{"fixed":"2.0.2-root.io.2"},{"fixed":"5.0.3-root.io.1"},{"fixed":"5.0.3-root.io.2"},{"fixed":"2.0.1-root.io.4"},{"fixed":"2.0.2-root.io.3"},{"fixed":"1.1.12-root.io.3"},{"fixed":"1.1.11-root.io.4"},{"fixed":"1.1.11-root.io.5"},{"fixed":"1.1.12-root.io.4"},{"fixed":"1.1.11-root.io.6"},{"fixed":"2.0.1-root.io.5"},{"fixed":"2.0.2-root.io.4"},{"fixed":"5.0.4-root.io.2"},{"fixed":"5.0.4-root.io.3"},{"fixed":"5.0.4-root.io.4"},{"fixed":"5.0.4-root.io.5"},{"fixed":"5.0.3-root.io.3"},{"fixed":"5.0.3-root.io.4"},{"fixed":"5.0.3-root.io.5"},{"fixed":"2.0.1-root.io.6"},{"fixed":"1.1.12-root.io.5"},{"fixed":"1.1.12-root.io.6"},{"fixed":"2.0.1-root.io.7"},{"fixed":"1.1.11-root.io.7"},{"fixed":"2.0.2-root.io.5"},{"fixed":"2.0.2-root.io.6"},{"fixed":"5.0.3-root.io.6"},{"fixed":"5.0.5-root.io.1"},{"fixed":"2.0.3-root.io.1"},{"fixed":"1.1.13-root.io.1"},{"fixed":"5.0.5-root.io.2"},{"fixed":"5.0.5-root.io.3"},{"fixed":"2.0.3-root.io.2"},{"fixed":"1.1.13-root.io.2"},{"fixed":"2.0.3-root.io.3"},{"fixed":"5.0.5-root.io.4"},{"fixed":"1.1.13-root.io.3"},{"fixed":"1.1.13-root.io.4"},{"fixed":"1.1.13-root.io.5"},{"fixed":"5.0.5-root.io.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.8-1","1.1.11-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0-1","2.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2","2.0.1+~1.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-1","2.0.1+~1.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2","2.0.3+~1.1.2-2","2.0.3+~1.1.2-3","2.1.4+~1.1.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-brace-expansion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1+~1.1.0-2"]}],"products":[{"vendor":"juliangruber","product":"brace-expansion"}],"references":[{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/issues/98","tags":["x_refsource_MISC","Issue Tracking","report","web"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/95","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/96","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/pull/97","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","tags":["x_refsource_MISC","Patch","web","report"]},{"url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","tags":["x_refsource_MISC","Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f886-m6hf-6m8v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33750.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33750","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1835","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33750","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33750","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33750","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T14:04:52.297Z","modified":"2026-03-27T14:48:06.779Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:07.609948Z"}],"euvd":[{"id":"EUVD-2026-16620","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T14:04:52Z","modified":"2026-03-27T14:48:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:27.277964Z"}],"ghsa":[{"id":"GHSA-f886-m6hf-6m8v","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"### Impact\n\nA brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.\n\nThe loop in question:\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184\n\n`test()` is one of\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113\n\nThe increment is computed as `Math.abs(0) = 0`, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a `RangeError`. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.\n\nThis affects any application that passes untrusted strings to expand(), or by error sets a step value of `0`. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.\n\n### Patches\n\n\nUpgrade to versions\n- 5.0.5+\n\nA step increment of 0 is now sanitized to 1, which matches bash behavior.\n\n### Workarounds\n\nSanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-26T18:29:42Z","modified":"2026-03-27T21:38:55Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:44.97342Z"}],"nvd":[{"id":"CVE-2026-33750","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T15:16:57.297Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-33750","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T14:04:52.297Z","modified":"2026-11-11T10:30:47.735978418Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-11T11:06:44.221111Z"},{"id":"DEBIAN-CVE-2026-33750","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T15:16:57.297Z","modified":"2026-10-27T10:00:52.022529324Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-f886-m6hf-6m8v","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"### Impact\n\nA brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.\n\nThe loop in question:\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184\n\n`test()` is one of\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113\n\nThe increment is computed as `Math.abs(0) = 0`, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a `RangeError`. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.\n\nThis affects any application that passes untrusted strings to expand(), or by error sets a step value of `0`. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.\n\n### Patches\n\n\nUpgrade to versions\n- 5.0.5+\n\nA step increment of 0 is now sanitized to 1, which matches bash behavior.\n\n### Workarounds\n\nSanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-26T18:29:42Z","modified":"2026-09-10T03:51:00.342356761Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"OESA-2026-1835","title":"nodejs-brace-expansion security update","description":"Brace expansion as known from sh/bash\r\n\r\nSecurity Fix(es):\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.(CVE-2026-33750)","status":"published","published":"2026-04-11T11:10:51Z","modified":"2026-08-18T01:19:45.889766152Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"ROOT-APP-NPM-CVE-2026-33750","title":"CVE-2026-33750 in brace-expansion - Patched by Root","description":"Root has patched CVE-2026-33750 in the brace-expansion package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-08T08:31:49Z","modified":"2026-10-08T09:15:23.157297911Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-33750","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T15:16:00Z","modified":"2026-10-17T12:58:11.437174169Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"AZL-81075","title":"CVE-2026-33750 affecting package js-jquery 3.5.0-4","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T15:16:57Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"AZL-81084","title":"CVE-2026-33750 affecting package nodejs-nodemon 2.0.3-5","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","status":"published","published":"2026-03-27T15:16:57Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1777250307","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.12-tuxcare.2.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:45:49.578204946Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1781830545","title":"TuxCare security update for brace-expansion (3 CVEs)","description":"TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.800463589Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781830551","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:47:09.338984981Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1792233308","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 4.0.1-tuxcare.3.","status":"published","published":"2026-10-17T10:35:08Z","modified":"2026-10-17T13:09:28.322028041Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792233325","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.4-tuxcare.4.","status":"published","published":"2026-10-17T10:35:25Z","modified":"2026-10-17T13:09:29.119932478Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792243228","title":"TuxCare security update for brace-expansion (4 CVEs)","description":"TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 2.0.2-tuxcare.4.","status":"published","published":"2026-10-17T13:20:28Z","modified":"2026-10-17T19:01:10.667768977Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792508599","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.3-tuxcare.2.","status":"published","published":"2026-10-20T15:03:19Z","modified":"2026-10-20T19:30:17.285848372Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793102029","title":"TuxCare security update for brace-expansion (5 CVEs)","description":"TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.","status":"published","published":"2026-10-27T11:53:49Z","modified":"2026-10-27T13:30:14.88045529Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793808088","title":"TuxCare security update for brace-expansion (1 CVE)","description":"TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.2-tuxcare.2.","status":"published","published":"2026-11-04T17:01:29Z","modified":"2026-11-04T19:00:37.288753013Z","updated_at":"2026-11-04T19:15:03.6858Z"}]}}