CVE-2026-33750

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33750
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113 Patch
https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184 Patch
https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5 Patch
https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2 Patch
https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a Patch
https://github.com/juliangruber/brace-expansion/issues/98 Issue Tracking
https://github.com/juliangruber/brace-expansion/pull/95 Issue Tracking Patch
https://github.com/juliangruber/brace-expansion/pull/96 Issue Tracking Patch
https://github.com/juliangruber/brace-expansion/pull/97 Issue Tracking Patch
https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*
cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*
cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*
cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*
History

22 Apr 2026, 14:23

Type Values Removed Values Added
References () https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113 - () https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113 - Patch
References () https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184 - () https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184 - Patch
References () https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5 - () https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5 - Patch
References () https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2 - () https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2 - Patch
References () https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a - () https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a - Patch
References () https://github.com/juliangruber/brace-expansion/issues/98 - () https://github.com/juliangruber/brace-expansion/issues/98 - Issue Tracking
References () https://github.com/juliangruber/brace-expansion/pull/95 - () https://github.com/juliangruber/brace-expansion/pull/95 - Issue Tracking, Patch
References () https://github.com/juliangruber/brace-expansion/pull/96 - () https://github.com/juliangruber/brace-expansion/pull/96 - Issue Tracking, Patch
References () https://github.com/juliangruber/brace-expansion/pull/97 - () https://github.com/juliangruber/brace-expansion/pull/97 - Issue Tracking, Patch
References () https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v - () https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v - Mitigation, Vendor Advisory
CPE cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*
First Time Juliangruber
Juliangruber brace-expansion

27 Mar 2026, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-27 15:16

Updated : 2026-04-22 14:23

NVD link : CVE-2026-33750

Mitre link : CVE-2026-33750

CVE.ORG link : CVE-2026-33750

JSON object : View

Products Affected

juliangruber

  • brace-expansion
CWE
CWE-400

Uncontrolled Resource Consumption