brace-expansion (npm)
Brace expansion, as known from sh/bash, in JavaScript
Advisories
65
Latest version
5.0.12
Released Sep 14, 2026
License
MIT
OpenSSF Scorecard
7.2 / 10
How to fix
Upgrading to 5.0.12 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install brace-expansion@5.0.12yarn
yarn add brace-expansion@5.0.12pnpm
pnpm add brace-expansion@5.0.12Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
< 1.1.20 | 1.1.20 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 4.0.0, < 5.0.11 | 5.0.11 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 3.0.0, < 3.0.8 | 3.0.8 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
< 1.1.20 | 1.1.20 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 4.0.0, < 5.0.11 | 5.0.11 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 3.0.0, < 3.0.8 | 3.0.8 |
| GHSA-qhr7-859c-m2p7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
High EPSS 0.49% |
>= 2.0.0, < 2.1.6 | 2.1.6 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 2.0.0, < 2.1.7 | 2.1.7 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 4.0.0, < 5.0.12 | 5.0.12 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 3.0.0, < 3.0.9 | 3.0.9 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 2.0.0, < 2.1.7 | 2.1.7 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
< 1.1.21 | 1.1.21 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 4.0.0, < 5.0.12 | 5.0.12 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
>= 3.0.0, < 3.0.9 | 3.0.9 |
| GHSA-q2hr-2g5m-vwhr brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service |
Medium EPSS 0.43% |
< 1.1.21 | 1.1.21 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
< 1.1.19 | 1.1.19 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 4.0.0, < 5.0.10 | 5.0.10 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 3.0.0, < 3.0.7 | 3.0.7 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 2.0.0, < 2.1.5 | 2.1.5 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
< 1.1.19 | 1.1.19 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 4.0.0, < 5.0.10 | 5.0.10 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 3.0.0, < 3.0.7 | 3.0.7 |
| GHSA-6j4f-fj2g-mc7p brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
High EPSS 0.46% |
>= 2.0.0, < 2.1.5 | 2.1.5 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 4.0.0, < 5.0.9 | 5.0.9 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 2.0.0, < 2.1.4 | 2.1.4 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 4.0.0, < 5.0.9 | 5.0.9 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
< 1.1.18 | 1.1.18 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 2.0.0, < 2.1.4 | 2.1.4 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
>= 3.0.0, < 3.0.6 | 3.0.6 |
| GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
High EPSS 0.65% |
< 1.1.18 | 1.1.18 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
< 1.1.17 | 1.1.17 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 4.0.0, < 5.0.8 | 5.0.8 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 3.0.0, < 3.0.3 | 3.0.3 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
< 1.1.17 | 1.1.17 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 4.0.0, < 5.0.8 | 5.0.8 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 3.0.0, < 3.0.3 | 3.0.3 |
| GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
High EPSS 0.64% |
>= 2.0.0, < 2.1.3 | 2.1.3 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
>= 2.0.0, < 2.1.2 | 2.1.2 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
>= 3.0.0, < 5.0.7 | 5.0.7 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
< 1.1.16 | 1.1.16 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
>= 3.0.0, < 5.0.7 | 5.0.7 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
< 1.1.16 | 1.1.16 |
| GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
High EPSS 0.36% |
>= 2.0.0, < 2.1.2 | 2.1.2 |
| GHSA-jxxr-4gwj-5jf2 brace-expansion: Large numeric range defeats documented `max` DoS protection |
High EPSS 0.30% |
>= 5.0.0, < 5.0.6 | 5.0.6 |
| GHSA-jxxr-4gwj-5jf2 brace-expansion: Large numeric range defeats documented `max` DoS protection |
High EPSS 0.30% |
>= 5.0.0, < 5.0.6 | 5.0.6 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
< 1.1.13 | 1.1.13 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 2.0.0, < 2.0.3 | 2.0.3 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 3.0.0, < 3.0.2 | 3.0.2 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 4.0.0, < 5.0.5 | 5.0.5 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
< 1.1.13 | 1.1.13 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 2.0.0, < 2.0.3 | 2.0.3 |
| GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion |
High EPSS 0.45% |
>= 4.0.0, < 5.0.5 | 5.0.5 |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 1.0.0, < 1.1.12 | 1.1.12 |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 2.0.0, < 2.0.2 | 2.0.2 |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
No fix yet | |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
No fix yet | |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 1.0.0, <= 1.1.11 | No fix yet |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 2.0.0, <= 2.0.1 | No fix yet |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 4.0.0, < 4.0.1 | 4.0.1 |
| GHSA-v6h2-p8h4-qcjw brace-expansion Regular Expression Denial of Service vulnerability |
Low EPSS 0.59% |
>= 3.0.0, < 3.0.1 | 3.0.1 |
| GHSA-832h-xg76-4gv6 ReDoS in brace-expansion |
High EPSS 2.58% |
< 1.1.7 | 1.1.7 |
Source: git+https://github.com/juliangruber/brace-expansion.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor