What’s Vulnerable › Vulnerabilities

CVE-2017-18077

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-27 · updated 2026-06-17
• Weakness: CWE-20

Description

index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

Affected products

• Brace Expansion Project Brace Expansion: before 1.1.7 — fixed in 1.1.7

How to fix

Upgrade to a fixed version: Brace Expansion Project Brace Expansion 1.1.7. Check the vendor advisory for mitigations.

References

• https://bugs.debian.org/862712
• https://github.com/juliangruber/brace-expansion/issues/33
• https://github.com/juliangruber/brace-expansion/pull/35/commits/b13381281cead487cbdbfd6a69fb097ea5e456c3
• https://nodesecurity.io/advisories/338
• https://bugs.debian.org/862712
• https://github.com/juliangruber/brace-expansion/issues/33
• https://github.com/juliangruber/brace-expansion/pull/35/commits/b13381281cead487cbdbfd6a69fb097ea5e456c3
• https://nodesecurity.io/advisories/338

Get alerted when CVE-2017-18077 or the next vulnerability affects your stack