CVE-2026-25547: @isaacs/brace-expansion DoS Vulnerability

CVE-2026-25547 Overview

CVE-2026-25547 is a Denial of Service (DoS) vulnerability in @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of the popular brace-expansion library. The vulnerability stems from unbounded brace range expansion, where an attacker can provide a malicious pattern containing repeated numeric brace ranges that causes the library to eagerly generate every possible combination synchronously. Due to exponential growth in expansion, even small malicious inputs can consume excessive CPU and memory resources, potentially crashing the Node.js process.

Critical Impact

Attackers can cause complete denial of service by providing specially crafted brace patterns that trigger exponential resource consumption, potentially crashing Node.js applications and affecting downstream system availability.

Affected Products

• @isaacs/brace-expansion versions prior to 5.0.1
• Applications using vulnerable versions of @isaacs/brace-expansion for glob pattern matching
• Node.js services processing untrusted brace expansion patterns

Discovery Timeline

• 2026-02-04 - CVE CVE-2026-25547 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25547

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), specifically manifesting as an algorithmic complexity attack. The @isaacs/brace-expansion library processes brace patterns (e.g., {1..100}) by synchronously generating all possible expansions in memory. When an attacker supplies nested or repeated numeric brace ranges, the library attempts to compute the Cartesian product of all combinations.

The fundamental issue lies in the library's eager evaluation strategy. Unlike lazy evaluation that would generate values on-demand, the synchronous generation approach allocates memory for the entire expansion set before returning results. This design becomes catastrophic when facing intentionally crafted input patterns that exploit the exponential growth characteristics.

Root Cause

The root cause is the lack of bounds checking or resource limits on brace range expansion operations. When processing patterns with numeric ranges, the library does not validate the potential output size before beginning expansion. This allows attackers to craft inputs where the number of combinations grows exponentially with each additional brace pattern, leading to unbounded resource consumption.

For example, a pattern like {1..10}{1..10}{1..10} would generate 1,000 combinations, but adding more range segments causes the output to grow exponentially. Without safeguards, the library will attempt to process arbitrarily large expansions until system resources are exhausted.

Attack Vector

The attack is network-accessible, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending malicious brace patterns to any application endpoint that processes user-supplied input through the vulnerable @isaacs/brace-expansion library.

The exploitation mechanism involves providing repeated numeric brace ranges that compound exponentially. When the library processes such patterns, it enters a computationally intensive loop, synchronously generating massive arrays that exhaust available memory and CPU cycles. This can cause the Node.js event loop to block, rendering the application unresponsive, or trigger an out-of-memory condition that crashes the process entirely.

The attack requires no special privileges and can be delivered through any input vector that eventually passes through the brace expansion function, such as file path inputs, search patterns, or configuration values.

Detection Methods for CVE-2026-25547

Indicators of Compromise

• Sudden spikes in Node.js process memory consumption without corresponding legitimate workload
• CPU utilization reaching 100% on processes handling brace expansion operations
• Application unresponsiveness or timeout errors in services using pattern matching
• Out-of-memory errors or process crashes in Node.js applications
• Unusual patterns containing multiple nested brace ranges in application logs

Detection Strategies

• Monitor Node.js process memory and CPU metrics for anomalous consumption patterns
• Implement input validation logging to detect malicious brace patterns before processing
• Deploy application-level monitoring to track brace expansion function execution times
• Use dependency scanning tools to identify vulnerable versions of @isaacs/brace-expansion

Monitoring Recommendations

• Configure alerting for Node.js heap memory exceeding normal operational thresholds
• Implement request timeout monitoring to detect blocked event loop conditions
• Enable process crash logging and monitoring for OOM (out-of-memory) kill events
• Track dependency versions in CI/CD pipelines to prevent deployment of vulnerable packages

How to Mitigate CVE-2026-25547

Immediate Actions Required

• Upgrade @isaacs/brace-expansion to version 5.0.1 or later immediately
• Audit applications to identify all instances of the vulnerable package in dependencies
• Implement input validation to reject or sanitize brace patterns from untrusted sources
• Consider implementing request timeouts and resource limits at the application level

Patch Information

The vulnerability has been patched in @isaacs/brace-expansion version 5.0.1. Organizations should update their dependencies to this version or later to remediate the vulnerability. The patch introduces bounds checking to prevent unbounded expansion of brace ranges.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement input length restrictions on patterns before passing to brace expansion functions
• Add preprocessing validation to reject patterns containing excessive or nested brace ranges
• Deploy rate limiting on endpoints that process user-supplied patterns
• Consider using alternative libraries with built-in expansion limits until upgrade is possible

# Update the package to the patched version
npm update @isaacs/brace-expansion@5.0.1

# Or install the specific patched version
npm install @isaacs/brace-expansion@5.0.1 --save

# Verify the installed version
npm list @isaacs/brace-expansion