Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | >= 5.0.0, < 5.0.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | 2.0.3+~1.1.2-3 | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 25.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | dotnet8.0 | 8.0.127-1.hum1 | RHSA-2026:17682 |
| Red Hat Hardened Images 1 | lld +43 | 21.1.8-1.1.hum1 | RHSA-2026:7634 |
| Red Hat Hardened Images 1 | lld21 +25 | 21.1.8-6.hum1 | RHSA-2026:24069 |
| Red Hat Hardened Images 1 | nodejs20 +6 | 20.20.2-1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs20-npm | 10.8.2-1.20.20.2.1.hum1 | RHSA-2026:9455 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 22.22.0-1.3.hum1 | RHSA-2026:7387 |
| Red Hat Hardened Images 1 | nodejs22-npm | 10.9.4-1.22.22.0.1.3.hum1 | RHSA-2026:7387 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.15.0-1.hum1 | RHSA-2026:13874 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.12.1-1.24.15.0.1.hum1 | RHSA-2026:13874 |
| Red Hat Hardened Images 1 | nodejs25 +6 | 25.9.0-1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | nodejs25-npm | 11.12.1-1.25.9.0.1.1.hum1 | RHSA-2026:7378 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.3.0-1.2.hum1 | RHSA-2026:22380 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.16.0-1.26.3.0.1.2.hum1 | RHSA-2026:22380 |
| Red Hat Hardened Images 1 | rust +18 | 1.96.0-1.hum1 | RHSA-2026:22934 |
| Red Hat Hardened Images 1 | yarnpkg | 1.22.22-18.1.hum1 | RHSA-2026:7655 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 | 3.2.2-r8 | — |
| Wolfi rolling | langfuse-3 +1 | 3.175.0-r0 | — |
| Wolfi rolling | lerna | 9.0.7-r5 | — |
| Wolfi rolling | npm | 11.15.0-r1 | — |
| Wolfi rolling | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 3.6.0-r5 | — |
| Wolfi rolling | prism | 5.15.10-r1 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.243.0-r2 | — |
| Wolfi rolling | renovate | 43.170.15-r2 | — |
| Wolfi rolling | tileserver-gl | 5.6.0-r3 | — |
| Wolfi rolling | ts-patch | 4.0.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | >= 5.0.0, < 5.0.6 | 5.0.6 | GHSA-jxxr-4gwj-5jf2 |
Advisories 12
- RHSA-2026:7655 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:7378 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22934 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:22380 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:9455 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:17682 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2026:7634 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:7387 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24069 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:13874 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-2118 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 4, 2026