What’s Vulnerable › Products

juliangruber brace-expansion vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your juliangruber brace-expansion version is affected

Latest juliangruber brace-expansion vulnerabilities

• CVE-2026-102278 — brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (CVSS 7.5)
• CVE-2026-102277 — brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service (CVSS 5.3)
• CVE-2026-102276 — brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (CVSS 7.5)
• CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVSS 7.5)
• CVE-2026-14257 — brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash (CVSS 7.5)
• CVE-2026-13149 — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups (CVSS 7.7)
• CVE-2026-45149 — brace-expansion: Large numeric range defeats documented `max` DoS protection (CVSS 7.5)
• CVE-2026-33750 — brace-expansion: Zero-step sequence causes process hang and memory exhaustion (CVSS 7.5)
• CVE-2025-5889 — juliangruber brace-expansion index.js expand redos (CVSS 3.1)