CVE-2026-33750: brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-400

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.

Affected products

juliangruber brace-expansion: before 1.1.13; from 2.0.0 before 2.0.3; from 3.0.0 before 3.0.2; from 5.0.0 before 5.0.5 — fixed in 1.1.13, 2.0.3, 3.0.2, 5.0.5
Npm Brace-Expansion: from 4.0.0 before 5.0.5; from 3.0.0 before 3.0.2; from 2.0.0 before 2.0.3; before 1.1.13 — fixed in 5.0.5, 3.0.2, 2.0.3, 1.1.13

How to fix

Upgrade to a fixed version: juliangruber brace-expansion 1.1.13, 2.0.3, 3.0.2, 5.0.5; Npm Brace-Expansion 5.0.5, 3.0.2, 2.0.3, 1.1.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-33750 or the next vulnerability affects your stack