Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | >= 4.0.0, < 5.0.10, >= 3.0.0, < 3.0.7, >= 2.0.0, < 2.1.5, < 1.1.19 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | 2.1.7+~1.1.2-1 | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cockpit-image-builder | 110.3-1.el10_3 | RHSA-2026:98613 |
| RHEL 10 | nodejs +5 | 1:22.23.4-1.el10_2 | RHSA-2026:96094 |
| RHEL 10 | nodejs-nodemon | 3.1.14-5.el10_2 | RHSA-2026:96236 |
| RHEL 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | RHSA-2026:96094 |
| RHEL 10 | nodejs24 +4 | 1:24.22.1-3.el10_2 | RHSA-2026:96088 |
| RHEL 10 | nodejs24-npm | 2:11.19.1-1.24.22.1.3.el10_2 | RHSA-2026:96088 |
| RHEL 10 | nodejs26 +4 | 1:26.12.1-3.el10_3 | RHSA-2026:98619 |
| RHEL 10 | nodejs26-npm | 1:11.20.0-1.26.12.1.3.el10_3 | RHSA-2026:98619 |
| RHEL 9 | nodejs +4 | 1:22.23.4-2.module+el9.8.0+25286+62e50b69 | RHSA-2026:98522, RHSA-2026:96234, RHSA-2026:96226 |
| RHEL 9 | nodejs-nodemon | 3.1.14-2.module+el9.9.0+25283+460aabd3 | RHSA-2026:98522, RHSA-2026:96234, RHSA-2026:96226 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:98522, RHSA-2026:96234, RHSA-2026:96226 |
| RHEL 9 | npm | 1:10.9.9-1.22.23.4.2.module+el9.8.0+25286+62e50b69 | RHSA-2026:98522, RHSA-2026:96234, RHSA-2026:96226 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.module+el9.8.0+25286+62e50b69 | RHSA-2026:96234 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4 | RHSA-2026:96226, RHSA-2026:92378 |
| RHEL 9 | v8-14.6-devel | 3:14.6.202.34-1.26.12.1.2.module+el9.9.0+25297+fc0af076 | RHSA-2026:98522 |
| RHEL 8 | nodejs +4 | 1:22.23.4-2.module+el8.10.0+25285+c731a801 | RHSA-2026:98113, RHSA-2026:98102, RHSA-2026:92376 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24711+b610b202 | RHSA-2026:98113, RHSA-2026:98102, RHSA-2026:92376 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24710+c2e9b41f | RHSA-2026:98113, RHSA-2026:98102, RHSA-2026:92376 |
| RHEL 8 | npm | 1:10.9.9-1.22.23.4.2.module+el8.10.0+25285+c731a801 | RHSA-2026:98113, RHSA-2026:98102, RHSA-2026:92376 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.module+el8.10.0+25285+c731a801 | RHSA-2026:98113 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb | RHSA-2026:98102, RHSA-2026:92376 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.2 EUS | cockpit-image-builder | 94.5-1.el10_2 | RHSA-2026:99115 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 1:22.23.3-2.3.2.2.hum1 | RHSA-2026:74161 |
| Red Hat Hardened Images 1 | nodejs22-npm | 1:10.9.9-1.22.23.3.2.3.2.2.hum1 | RHSA-2026:74161 |
| Red Hat Hardened Images 1 | nodejs24 +5 | 1:24.21.0-1.2.hum1 | RHSA-2026:74167 |
| Red Hat Hardened Images 1 | nodejs24-npm +1 | 2:11.19.0-1.24.21.0.1.2.hum1 | RHSA-2026:74167 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.11.1-0.4.hum1 | RHSA-2026:84657, RHSA-2026:74168 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.20.0-1.26.11.1.0.4.hum1 | RHSA-2026:84657, RHSA-2026:74168 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.2.hum1 | RHSA-2026:74167 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.11.1.0.4.hum1 | RHSA-2026:84657 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | ALSA-2026:96236 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ALSA-2026:96094 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.22.1-3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 10 | nodejs24-npm | 2:11.19.1-1.24.22.1.3.el10_2 | ALSA-2026:96088 |
| AlmaLinux 9 | nodejs +4 | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:96234, ALSA-2026:92378 |
| AlmaLinux 9 | npm | 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.4-2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | npm | 1:10.9.9-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113, ALSA-2026:98102, ALSA-2026:92376 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.4.2.module_el8.10.0+4358+709b81be | ALSA-2026:98113 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:98102, ALSA-2026:92376 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-image-builder | 110.3-1.el10_3 | RLSA-2026:98613 |
| Rocky Linux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | RLSA-2026:96236 |
| Rocky Linux 10 | nodejs22 | 1:22.23.4-1.el10_2 | RLSA-2026:96094 |
| Rocky Linux 10 | nodejs24 | 1:24.22.1-3.el10_2 | RLSA-2026:96088 |
| Rocky Linux 9 | nodejs | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95 | RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:98522, RLSA-2026:96234, RLSA-2026:96226 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:98102, RLSA-2026:92376 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:98113, RLSA-2026:98102, RLSA-2026:92376 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pi-coding-agent | 1.0.2-1.1 | openSUSE-SU-2026:12062-1 |
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.3-1.amzn2023.0.1 | ALAS2023-2026-3277 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.3.1.amzn2023.0.1 | ALAS2023-2026-3277 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.0-1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.3.1.amzn2023.0.1 | ALAS2023-2026-3277 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.4-1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 10 | nodejs-nodemon | 3.1.14-5.el10_2 | ELSA-2026-96236 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.9-1.22.23.4.1.el10_2 | ELSA-2026-96094 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.2-2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234, ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.0.1.module+el9.8.0+91110+558b6b61 | ELSA-2026-96234 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4 | ELSA-2026-96226, ELSA-2026-92378 |
| Oracle Linux 8 | nodejs +4 | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r6 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.9-r1 | — |
| Wolfi rolling | npm-12 | 12.1.0-r2 | — |
| Wolfi rolling | opensearch-dashboards-3 +5 | 3.8.0-r9 | — |
| Wolfi rolling | prism | 5.16.0-r12 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r13 | — |
| Wolfi rolling | renovate | 44.133.0-r1 | — |
| Wolfi rolling | sqlpad | 7.5.7-r43 | — |
| Wolfi rolling | ts-patch | 4.0.1-r46 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | >= 4.0.0, < 5.0.10 | 5.0.10 | GHSA-6j4f-fj2g-mc7p |
| npm | brace-expansion | >= 3.0.0, < 3.0.7 | 3.0.7 | GHSA-6j4f-fj2g-mc7p |
| npm | brace-expansion | >= 2.0.0, < 2.1.5 | 2.1.5 | GHSA-6j4f-fj2g-mc7p |
| npm | brace-expansion | < 1.1.19 | 1.1.19 | GHSA-6j4f-fj2g-mc7p |
Advisories 47
- RHSA-2026:98102 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96234 Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98113 Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96094 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98613 Red Hat Security Advisory: cockpit-image-builder security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96088 Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96226 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98522 Red Hat Security Advisory: nodejs:26 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:98619 Red Hat Security Advisory: nodejs26 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:99115 Red Hat Security Advisory: cockpit-image-builder security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:96236 Red Hat Security Advisory: nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92376 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92378 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74161 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74167 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74168 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:98613 Critical: cockpit-image-builder security update Rocky Linux Security Advisories · Nov 13, 2026
- ALSA-2026:98102 Important: nodejs:24 security update AlmaLinux Security Advisories · Nov 13, 2026
- ALSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 13, 2026
- RLSA-2026:98522 Important: nodejs:26 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 12, 2026
- WID-SEC-2026-4438 Red Hat Enterprise Linux (nodejs-nodemon): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:98113 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 11, 2026
- RLSA-2026:98102 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 11, 2026
- ELSA-2026-96234 Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2026
- RLSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96236 Important: nodejs-nodemon security update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96094 Important: nodejs22 security update Rocky Linux Security Advisories · Nov 10, 2026
- ALSA-2026:96088 Important: nodejs24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96094 Important: nodejs22 security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96236 Important: nodejs-nodemon security update AlmaLinux Security Advisories · Nov 10, 2026
- ALSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update AlmaLinux Security Advisories · Nov 10, 2026
- RLSA-2026:96226 Important: nodejs:24 security update Rocky Linux Security Advisories · Nov 10, 2026
- RLSA-2026:96234 Important: nodejs:22 security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 10, 2026
- ELSA-2026-96094 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96236 Important: nodejs-nodemon security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- ELSA-2026-96226 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 9, 2026
- RLSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- ELSA-2026-92378 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ELSA-2026-92376 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3277 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- ALAS2023-2026-3297 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:84657 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:12062-1 pi-coding-agent-1.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 6, 2026
References
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
- https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
- https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
- https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
- https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3