brace-expansion

Security advisories8

• brace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsfixed in 5.0.7, 1.1.16, 2.1.2
• brace-expansion: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionfixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19
• brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustionfixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13
• brace-expansion: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashfixed in 5.0.8, 3.0.3, 2.1.3, 1.1.17
• brace-expansion: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of servicefixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21
• brace-expansion: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionfixed in 5.0.11, 3.0.8, 2.1.6, 1.1.20
• brace-expansion: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationfixed in 1.1.18, 2.1.4, 3.0.6, 5.0.9
• brace-expansion: brace-expansion Regular Expression Denial of Service vulnerabilityfixed in 2.0.2, 1.1.12, 3.0.1, 4.0.1

Versions that change something