npmPackage

brace-expansion

10 known vulnerabilities (5 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release: 5.0.12 (Sep 14, 2026): no advisory affects it
Newest unaffected release: 5.0.12 (Sep 14, 2026), the latest release
Advisories: 10 · 5 high, 3 medium, 1 low

Weekly downloads: 819.6M
Dependents: 109.7K
Releases: 60 since 0.0.0 (Oct 13, 2013)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-102278
Affects 0.0.0 to 1.1.19 (1.1.20 is outside it); 2.0.0 to 2.1.5 (2.1.6 is outside it); 3.0.0 to 3.0.7 (3.0.8 is outside it); 4.0.0 to 5.0.10 (5.0.11 is outside it)
CVE-2026-102277
Affects 0.0.0 to 1.1.20 (1.1.21 is outside it); 2.0.0 to 2.1.6 (2.1.7 is outside it); 3.0.0 to 3.0.8 (3.0.9 is outside it); 4.0.0 to 5.0.11 (5.0.12 is outside it)
CVE-2026-102276
Affects 0.0.0 to 1.1.18 (1.1.19 is outside it); 2.0.0 to 2.1.4 (2.1.5 is outside it); 3.0.0 to 3.0.6 (3.0.7 is outside it); 4.0.0 to 5.0.9 (5.0.10 is outside it)
CVE-2026-69152
Affects 0.0.0 to 1.1.17 (1.1.18 is outside it); 2.0.0 to 2.1.3 (2.1.4 is outside it); 3.0.0 to 3.0.5 (3.0.6 is outside it); 4.0.0 to 5.0.8 (5.0.9 is outside it)
CVE-2026-14257
Affects 0.0.0 to 5.0.7 (5.0.8 is outside it)
CVE-2026-13149
Affects 0.0.0 to 5.0.6 (5.0.7 is outside it)
CVE-2026-45149
Affects 5.0.2 to 5.0.5 (5.0.6 is outside it)
CVE-2026-33750
Affects 0.0.0 to 1.1.12 (1.1.13 is outside it); 2.0.0 to 2.0.2 (2.0.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it); 4.0.0 to 5.0.4 (5.0.5 is outside it)
CVE-2025-5889
Affects 1.0.0 to 1.1.11 (1.1.12 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 3.0.0 (3.0.1 is outside it); 4.0.0 (4.0.1 is outside it)
CVE-2017-18077
Affects 0.0.0 to 1.1.6 (1.1.7 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-102278High 7.5
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Affected: from 4.0.0, fixed in 5.0.11; from 3.0.0, fixed in 3.0.8; from 2.0.0, fixed in 2.1.6; fixed in 1.1.20.
Fixed in 1.1.20 (released Sep 14, 2026, 14 days before disclosure), 2.1.6 (released Sep 14, 2026, 14 days before disclosure), 3.0.8 (released Sep 14, 2026, 14 days before disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
53% of brace-expansion downloads last week were affected versions (478.4M).
CVE-2026-102277Medium 5.3
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Affected: from 4.0.0, fixed in 5.0.12; from 3.0.0, fixed in 3.0.9; from 2.0.0, fixed in 2.1.7; fixed in 1.1.21.
Fixed in 1.1.21 (released Sep 14, 2026, 14 days before disclosure), 2.1.7 (released Sep 14, 2026, 14 days before disclosure), 3.0.9 (released Sep 14, 2026, 14 days before disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
53% of brace-expansion downloads last week were affected versions (481.5M).
CVE-2026-102276High 7.5
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Affected: from 4.0.0, fixed in 5.0.10; from 3.0.0, fixed in 3.0.7; from 2.0.0, fixed in 2.1.5; fixed in 1.1.19.
Fixed in 1.1.19 (released Sep 14, 2026, 14 days before disclosure), 2.1.5 (released Sep 14, 2026, 14 days before disclosure), 3.0.7 (released Sep 14, 2026, 14 days before disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
52% of brace-expansion downloads last week were affected versions (478.3M).
CVE-2026-69152High 7.5
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Affected: fixed in 1.1.18; from 2.0.0, fixed in 2.1.4; from 3.0.0, fixed in 3.0.6; from 4.0.0, fixed in 5.0.9.
Fixed in 1.1.18 (released Jul 30, 2026, 4 days before disclosure), 2.1.4 (released Jul 30, 2026, 4 days before disclosure), 3.0.6 (released Jul 30, 2026, 4 days before disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
43% of brace-expansion downloads last week were affected versions (390.9M).
CVE-2026-14257High 7.5
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
Affected: through 5.0.7; from 4.0.0, fixed in 5.0.8; from 3.0.0, fixed in 3.0.3; from 2.0.0, fixed in 2.1.3; fixed in 1.1.17.
Fixed in 5.0.8 (released Jul 23, 2026, the day of disclosure).
The latest release, 5.0.12, is not affected.
77% of brace-expansion downloads last week were affected versions (697M).
CVE-2026-13149High 7.7
brace-expansion through 5.0.6 is vulnerable to denial of service.
Affected: through 5.0.6; from 3.0.0, fixed in 5.0.7; fixed in 1.1.16; from 2.0.0, fixed in 2.1.2.
Fixed in 5.0.7 (released Jun 29, 2026, 1 day before disclosure).
The latest release, 5.0.12, is not affected.
75% of brace-expansion downloads last week were affected versions (686.1M).
CVE-2026-45149Medium 6.5
brace-expansion: Large numeric range defeats documented `max` DoS protection
Affected: from 5.0.0, fixed in 5.0.6.
Fixed in 5.0.6 (released May 8, 2026, 21 days before disclosure).
The latest release, 5.0.12, is not affected.
3.2% of brace-expansion downloads last week were affected versions (29.1M).
CVE-2026-33750Medium 6.5
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Affected: from 4.0.0, fixed in 5.0.5; from 3.0.0, fixed in 3.0.2; from 2.0.0, fixed in 2.0.3; fixed in 1.1.13.
Fixed in 1.1.13 (released Mar 27, 2026, the day of disclosure), 2.0.3 (released Mar 27, 2026, the day of disclosure), 3.0.2 (released Mar 27, 2026, the day of disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
26% of brace-expansion downloads last week were affected versions (234.7M).
CVE-2025-5889Low 2.3
juliangruber brace-expansion index.js expand redos
Affected: from 2.0.0, fixed in 2.0.2; from 1.0.0, fixed in 1.1.12; from 3.0.0, fixed in 3.0.1; from 4.0.0, fixed in 4.0.1.
Fixed in 1.1.12 (released Jun 11, 2025, 2 days after disclosure), 2.0.2 (released Jun 11, 2025, 2 days after disclosure), 3.0.1 (released Jun 11, 2025, 2 days after disclosure) and 1 other version.
The latest release, 5.0.12, is not affected.
9.5% of brace-expansion downloads last week were affected versions (86.3M).
CVE-2017-18077Unrated
index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an…
Affected: fixed in 1.1.7.
Fixed in 1.1.7 (released Apr 7, 2017, 295 days before disclosure).
The latest release, 5.0.12, is not affected.
<0.1% of brace-expansion downloads last week were affected versions (121.5K).