Description
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | ≤ 5.0.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | No fix yet | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.23.1-6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | rh-podman-desktop | 1.1.2-1.el10_2 | RHSA-2026:57590 |
| RHEL 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24156+bb41d456 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55601 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee | RHSA-2026:55603 |
| RHEL 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24639+56878497 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24500+8eb51621 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.23.2-1.el10_0 | RHSA-2026:64817 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.8-1.22.23.2.1.el10_0 | RHSA-2026:64817 |
| RHEL 9.6 EUS | nodejs +4 | 1:22.23.2-1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.1.14-2.module+el9.6.0+24789+4011c12f | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:62416 |
| RHEL 9.6 EUS | npm | 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.4.hum1 | RHSA-2026:50290 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 1:22.23.1-2.3.hum1 | RHSA-2026:45381 |
| Red Hat Hardened Images 1 | nodejs22-npm | 1:10.9.8-1.22.23.1.2.3.hum1 | RHSA-2026:45381 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 1:24.18.0-0.5.hum1 | RHSA-2026:54183, RHSA-2026:45784 |
| Red Hat Hardened Images 1 | nodejs24-npm | 1:11.16.0-1.24.18.0.0.5.hum1 | RHSA-2026:54183, RHSA-2026:45784 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.5.0-1.4.hum1 | RHSA-2026:54389, RHSA-2026:45360 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.17.0-1.26.5.0.1.4.hum1 | RHSA-2026:54389, RHSA-2026:45360 |
| Red Hat Hardened Images 1 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.2.3.hum1 | RHSA-2026:45381 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 3:13.6.233.17-1.24.18.1.0.2.1.hum1 | RHSA-2026:54183 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 3:14.6.202.34-1.26.5.0.1.4.hum1 | RHSA-2026:54389, RHSA-2026:45360 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.1-6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 9 | nodejs +4 | 1:22.23.1-3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | npm | 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55601 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:55603 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.1-3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | npm | 1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs22 | 1:22.23.1-6.el10_2 | RLSA-2026:55541 |
| Rocky Linux 10 | nodejs24 | 1:24.18.0-5.el10_2 | RLSA-2026:58819 |
| Rocky Linux 9 | nodejs | 1:22.23.1-3.module+el9.8.0+40280+057606e8 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 8 | nodejs | 1:22.23.1-3.module+el8.10.0+40278+50b003a3 | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:54530, RLSA-2026:54371 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.76.7.0.git145.b60ef1146-1.1 | openSUSE-SU-2026:12070-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.0-1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +1 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.1-6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.18.0-5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+90946+13dc792a | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55601 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90968+e271b286 | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.8-r2 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-suggestion-hyperopt | 0.19.0-r40 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.224.3-r0 | — |
| Wolfi rolling | lerna | 9.0.7-r11 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.7-r2 | — |
| Wolfi rolling | npm | 12.0.1-r2 | — |
| Wolfi rolling | opensearch-dashboards-3 +6 | 3.7.0-r11 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-maps +5 | 3.7.0-r8 | — |
| Wolfi rolling | pnpm-stage0 | No fix yet | — |
| Wolfi rolling | prism | 5.16.0-r4 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.253.0-r2 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r11 | — |
| Wolfi rolling | renovate | 44.11.3-r0 | — |
| Wolfi rolling | saf | 1.6.0-r4 | — |
| Wolfi rolling | serve | 14.2.6-r5 | — |
| Wolfi rolling | sqlpad | 7.5.7-r29 | — |
| Wolfi rolling | thingsboard-tb-web-ui +1 | 4.3.1.3-r14 | — |
| Wolfi rolling | ts-patch | 4.0.1-r41 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | >= 4.0.0, < 5.0.8 | 5.0.8 | GHSA-mh99-v99m-4gvg |
| npm | brace-expansion | >= 3.0.0, < 3.0.3 | 3.0.3 | GHSA-mh99-v99m-4gvg |
| npm | brace-expansion | >= 2.0.0, < 2.1.3 | 2.1.3 | GHSA-mh99-v99m-4gvg |
| npm | brace-expansion | < 1.1.17 | 1.1.17 | GHSA-mh99-v99m-4gvg |
Advisories 40
- RHSA-2026:54389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:54183 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:45381 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:45360 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:45784 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:64817 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-2816 Red Hat Enterprise Linux (nodejs:24): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:55601 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58819 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55541 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55603 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54371 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54530 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3297 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:62416 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:58819 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55603 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55601 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55541 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54530 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54371 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50290 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12070-1 velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
- RLSA-2026:58819 Important: nodejs24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55601 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55603 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54371 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54530 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- ELSA-2026-58819 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- RLSA-2026:55541 Important: nodejs22 security update Rocky Linux Security Advisories · Aug 18, 2026
- ELSA-2026-55603 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55601 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55541 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- ELSA-2026-54371 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- ELSA-2026-54530 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026