CVE-2026-25547: @isaacs/brace-expansion: denial of service via unbounded brace range expansion
CVE-2026-25547 affects @isaacs/brace-expansion versions prior to 5.0.1. Repeated numeric brace ranges make the library synchronously generate every combination, which can exhaust CPU and memory and crash a Node.js process. The fix is in version 5.0.1, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-25547 is a denial of service issue in @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion. According to the record, versions prior to 5.0.1 are affected and the issue is patched in 5.0.1. The weakness is classified as CWE-1333, inefficient regular expression complexity.
Impact
- Numeric brace ranges are expanded eagerly and synchronously, and the output grows exponentially when ranges are repeated.
- A small input can consume excessive CPU and memory.
- The Node.js process may crash, interrupting any service that relies on the library to process untrusted patterns.
The CVSS 4.0 base score reported by the CNA is 9.2 (critical). The vector indicates network attack vector, low complexity, no privileges, no user interaction, and high impact on availability for the vulnerable system and on subsequent systems, with no confidentiality or integrity impact.
Affected products and versions
- Product: @isaacs/brace-expansion (fork of brace-expansion).
- Affected: versions prior to 5.0.1.
- The record does not provide a lower bound for the affected range, so the earliest vulnerable version is unknown.
- The record contains no structured affected or fixed entries; the fix version comes from the description text.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. No EPSS score is available in the record.
Remediation and mitigation
- Upgrade @isaacs/brace-expansion to version 5.0.1 or later, as stated in the record.
- Identify transitive dependencies in lock files and software bill of materials, since the library may be included indirectly.
- Where patching is delayed, validate or limit the length and structure of brace patterns that come from untrusted sources.
- Run Node.js services under process supervision with memory and CPU limits so that a crash is contained and recovered.
See the GitHub security advisory for the vendor description.
Detection guidance
- Monitor for sudden CPU or memory spikes and unexpected restarts of Node.js processes that handle user-supplied patterns.
- Review dependency inventories for installed versions of @isaacs/brace-expansion below 5.0.1.
Limitations of the available information
- The record has no structured affected version range, fixed version list, KEV or EPSS data, or SSVC data.
- The lower bound of the vulnerable range is unknown.
- The record has no title, so the title in this analysis was derived from the description.
- Details beyond the description and the GitHub advisory link were not available in the record.
Frequently asked questions
What does CVE-2026-25547 affect?
According to the record, @isaacs/brace-expansion versions prior to 5.0.1 are affected by a denial of service issue caused by unbounded brace range expansion.
Which version fixes the issue?
The record states that the issue has been patched in version 5.0.1. Upgrading to that version or later is the main remediation.
Is this vulnerability being actively exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.