brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.10, 3.0.7, 2.1.5, 1.1.19
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- juliangruber brace-expansion
From 4.0.0 · fixed in 5.0.10; From 3.0.0 · fixed in 3.0.7; From 2.0.0 · fixed in 2.1.5; fixed in 1.1.19
- brace-expansionnpm
From 4.0.0 · fixed in 5.0.10
- brace-expansionnpm
From 3.0.0 · fixed in 3.0.7
- brace-expansionnpm
From 2.0.0 · fixed in 2.1.5
- brace-expansionnpm
fixed in 1.1.19