# brace-expansion (npm) vulnerabilities 10 known vulnerabilities (5 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.0.12 (Sep 14, 2026): no advisory affects it - Newest unaffected release: 5.0.12 (Sep 14, 2026), the latest release - Weekly downloads: 819.6M - Dependents: 109.7K - Releases: 60 since 0.0.0 (Oct 13, 2013) - Registry: https://www.npmjs.com/package/brace-expansion - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-102278: 0.0.0 to 1.1.19 (1.1.20 is outside it); 2.0.0 to 2.1.5 (2.1.6 is outside it); 3.0.0 to 3.0.7 (3.0.8 is outside it); 4.0.0 to 5.0.10 (5.0.11 is outside it) - CVE-2026-102277: 0.0.0 to 1.1.20 (1.1.21 is outside it); 2.0.0 to 2.1.6 (2.1.7 is outside it); 3.0.0 to 3.0.8 (3.0.9 is outside it); 4.0.0 to 5.0.11 (5.0.12 is outside it) - CVE-2026-102276: 0.0.0 to 1.1.18 (1.1.19 is outside it); 2.0.0 to 2.1.4 (2.1.5 is outside it); 3.0.0 to 3.0.6 (3.0.7 is outside it); 4.0.0 to 5.0.9 (5.0.10 is outside it) - CVE-2026-69152: 0.0.0 to 1.1.17 (1.1.18 is outside it); 2.0.0 to 2.1.3 (2.1.4 is outside it); 3.0.0 to 3.0.5 (3.0.6 is outside it); 4.0.0 to 5.0.8 (5.0.9 is outside it) - CVE-2026-14257: 0.0.0 to 5.0.7 (5.0.8 is outside it) - CVE-2026-13149: 0.0.0 to 5.0.6 (5.0.7 is outside it) - CVE-2026-45149: 5.0.2 to 5.0.5 (5.0.6 is outside it) - CVE-2026-33750: 0.0.0 to 1.1.12 (1.1.13 is outside it); 2.0.0 to 2.0.2 (2.0.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it); 4.0.0 to 5.0.4 (5.0.5 is outside it) - CVE-2025-5889: 1.0.0 to 1.1.11 (1.1.12 is outside it); 2.0.0 to 2.0.1 (2.0.2 is outside it); 3.0.0 (3.0.1 is outside it); 4.0.0 (4.0.1 is outside it) - CVE-2017-18077: 0.0.0 to 1.1.6 (1.1.7 is outside it) ## Advisories (10) ### [CVE-2026-102278](https://cve.now/CVE-2026-102278): brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion - Severity: High 7.5 - Published: Sep 28, 2026 - Affected: from 4.0.0, fixed in 5.0.11; from 3.0.0, fixed in 3.0.8; from 2.0.0, fixed in 2.1.6; fixed in 1.1.20. - Fixed in 1.1.20 (released Sep 14, 2026, 14 days before disclosure), 2.1.6 (released Sep 14, 2026, 14 days before disclosure), 3.0.8 (released Sep 14, 2026, 14 days before disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 53% of brace-expansion downloads last week were affected versions (478.4M). ### [CVE-2026-102277](https://cve.now/CVE-2026-102277): brace-expansion: Quadratic-time expansion of the \`{a},b}\` rewrite causes CPU denial of service - Severity: Medium 5.3 - Published: Sep 28, 2026 - Affected: from 4.0.0, fixed in 5.0.12; from 3.0.0, fixed in 3.0.9; from 2.0.0, fixed in 2.1.7; fixed in 1.1.21. - Fixed in 1.1.21 (released Sep 14, 2026, 14 days before disclosure), 2.1.7 (released Sep 14, 2026, 14 days before disclosure), 3.0.9 (released Sep 14, 2026, 14 days before disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 53% of brace-expansion downloads last week were affected versions (481.5M). ### [CVE-2026-102276](https://cve.now/CVE-2026-102276): brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion - Severity: High 7.5 - Published: Sep 28, 2026 - Affected: from 4.0.0, fixed in 5.0.10; from 3.0.0, fixed in 3.0.7; from 2.0.0, fixed in 2.1.5; fixed in 1.1.19. - Fixed in 1.1.19 (released Sep 14, 2026, 14 days before disclosure), 2.1.5 (released Sep 14, 2026, 14 days before disclosure), 3.0.7 (released Sep 14, 2026, 14 days before disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 52% of brace-expansion downloads last week were affected versions (478.3M). ### [CVE-2026-69152](https://cve.now/CVE-2026-69152): brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation - Severity: High 7.5 - Published: Aug 3, 2026 - Affected: fixed in 1.1.18; from 2.0.0, fixed in 2.1.4; from 3.0.0, fixed in 3.0.6; from 4.0.0, fixed in 5.0.9. - Fixed in 1.1.18 (released Jul 30, 2026, 4 days before disclosure), 2.1.4 (released Jul 30, 2026, 4 days before disclosure), 3.0.6 (released Jul 30, 2026, 4 days before disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 43% of brace-expansion downloads last week were affected versions (390.9M). ### [CVE-2026-14257](https://cve.now/CVE-2026-14257): brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash - Severity: High 7.5 - Published: Jul 23, 2026 - Affected: through 5.0.7; from 4.0.0, fixed in 5.0.8; from 3.0.0, fixed in 3.0.3; from 2.0.0, fixed in 2.1.3; fixed in 1.1.17. - Fixed in 5.0.8 (released Jul 23, 2026, the day of disclosure). - The latest release, 5.0.12, is not affected. - 77% of brace-expansion downloads last week were affected versions (697M). ### [CVE-2026-13149](https://cve.now/CVE-2026-13149): brace-expansion through 5.0.6 is vulnerable to denial of service. - Severity: High 7.7 - Published: Jun 30, 2026 - Affected: through 5.0.6; from 3.0.0, fixed in 5.0.7; fixed in 1.1.16; from 2.0.0, fixed in 2.1.2. - Fixed in 5.0.7 (released Jun 29, 2026, 1 day before disclosure). - The latest release, 5.0.12, is not affected. - 75% of brace-expansion downloads last week were affected versions (686.1M). ### [CVE-2026-45149](https://cve.now/CVE-2026-45149): brace-expansion: Large numeric range defeats documented \`max\` DoS protection - Severity: Medium 6.5 - Published: May 29, 2026 - Affected: from 5.0.0, fixed in 5.0.6. - Fixed in 5.0.6 (released May 8, 2026, 21 days before disclosure). - The latest release, 5.0.12, is not affected. - 3.2% of brace-expansion downloads last week were affected versions (29.1M). ### [CVE-2026-33750](https://cve.now/CVE-2026-33750): brace-expansion: Zero-step sequence causes process hang and memory exhaustion - Severity: Medium 6.5 - Published: Mar 27, 2026 - Affected: from 4.0.0, fixed in 5.0.5; from 3.0.0, fixed in 3.0.2; from 2.0.0, fixed in 2.0.3; fixed in 1.1.13. - Fixed in 1.1.13 (released Mar 27, 2026, the day of disclosure), 2.0.3 (released Mar 27, 2026, the day of disclosure), 3.0.2 (released Mar 27, 2026, the day of disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 26% of brace-expansion downloads last week were affected versions (234.7M). ### [CVE-2025-5889](https://cve.now/CVE-2025-5889): juliangruber brace-expansion index.js expand redos - Severity: Low 2.3 - Published: Jun 9, 2025 - Affected: from 2.0.0, fixed in 2.0.2; from 1.0.0, fixed in 1.1.12; from 3.0.0, fixed in 3.0.1; from 4.0.0, fixed in 4.0.1. - Fixed in 1.1.12 (released Jun 11, 2025, 2 days after disclosure), 2.0.2 (released Jun 11, 2025, 2 days after disclosure), 3.0.1 (released Jun 11, 2025, 2 days after disclosure) and 1 other version. - The latest release, 5.0.12, is not affected. - 9.5% of brace-expansion downloads last week were affected versions (86.3M). ### [CVE-2017-18077](https://cve.now/CVE-2017-18077): index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an… - Severity: Unrated - Published: Jan 27, 2018 - Affected: fixed in 1.1.7. - Fixed in 1.1.7 (released Apr 7, 2017, 295 days before disclosure). - The latest release, 5.0.12, is not affected. - <0.1% of brace-expansion downloads last week were affected versions (121.5K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/brace-expansion Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.