CVE-2025-5889

What it actually does

This is a denial-of-service weakness in the brace-expansion JavaScript package's expand logic in index.js. Maliciously crafted brace patterns can trigger inefficient regular-expression or parsing behavior, causing excessive CPU consumption and event-loop blocking in Node.js processes that pass attacker-controlled input to brace expansion. The impact is limited to availability; the issue does not directly provide code execution, data theft, or privilege escalation. Exploitation is considered difficult and high-complexity because an attacker must reach an application path that invokes brace expansion with controllable input and provide input that meaningfully amplifies processing cost.

Why it matters to the business

Applications, build tools, developer platforms, CI/CD systems, file-matching services, or APIs that process user-controlled glob or brace patterns through affected versions may experience slowdowns, request timeouts, degraded service quality, or partial outages. Because brace-expansion is commonly pulled in transitively by JavaScript tooling, exposure may exist even when the package is not used directly. Risk is moderated by the low CVSS score, low EPSS probability, lack of KEV listing, no known ransomware association, and high exploitation complexity, but the issue should still be remediated through dependency updates because public exploit details are available and the package is widely reusable across Node.js ecosystems.

How an attack unfolds

An attacker first identifies an application feature that accepts pattern-like input, such as file globs, include or exclude filters, search masks, archive paths, repository tooling parameters, or build configuration fields. If that input is passed into an affected brace-expansion version, the attacker submits a specially crafted brace expression designed to maximize expansion or regular-expression processing cost. The vulnerable expand function then spends disproportionate CPU time parsing or expanding the pattern, which can block the Node.js event loop or slow worker processes. Repeated submissions may cause sustained latency, failed requests, autoscaling pressure, or service unavailability. The attacker generally does not gain access to data or execution control; the objective is resource exhaustion.

How to fix it

Upgrade brace-expansion to a fixed version appropriate for the major release line: 1.1.12, 2.0.2, 3.0.1, or 4.0.1. For source-based deployments of juliangruber/brace-expansion, ensure the repository includes the fixed commit c85b8ad3f53d1eb65f4996a495cae61949855f7c or an equivalent patched release. For Chainguard kapp-fips, upgrade to 0.64.0-r1 or later. Because this package is often transitive, update package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and container image dependencies, then rebuild and redeploy artifacts. If immediate upgrade is not possible, reduce exposure by rejecting or length-limiting untrusted brace/glob patterns, bounding expansion counts, applying request timeouts, rate-limiting pattern-processing endpoints, isolating pattern processing in worker processes, and monitoring CPU saturation in Node.js services.

How to confirm the fix worked

Confirm that dependency inventory and software composition analysis no longer report brace-expansion versions 1.1.11 or earlier in the 1.x line, 2.0.1 or earlier in the 2.x line, 3.0.0 or earlier in the 3.x line, or 4.0.0 or earlier in the 4.x line. Validate fixed package versions using package manager commands such as npm ls brace-expansion, yarn why brace-expansion, pnpm why brace-expansion, or SBOM/container scans. Confirm kapp-fips images or packages are at 0.64.0-r1 or later where applicable. Exercise application features that accept pattern syntax with normal and intentionally large inputs to verify that requests are bounded by input validation, timeout controls, and acceptable CPU behavior. Rebuild and redeploy from clean dependency locks so older transitive copies are not retained in shipped artifacts.

Typical attack path

1. Discover an externally reachable or authenticated feature that accepts glob, brace, path-pattern, or filter syntax.
2. Confirm that submitted patterns are processed by JavaScript tooling or application code that depends on brace-expansion.
3. Craft a complex brace expression intended to trigger inefficient expansion or regex complexity in the vulnerable expand function.
4. Submit the payload to the vulnerable endpoint, job, build, or processing workflow.
5. Repeat or parallelize requests to consume CPU, block the Node.js event loop, and cause timeouts or degraded availability.

How to detect it

There are no reliable universal indicators proving exploitation because successful abuse primarily appears as resource exhaustion rather than a unique file, process, or network artifact. Review application access logs, API gateway logs, reverse proxy logs, job queue records, build-system logs, and Node.js application logs for requests or job parameters containing unusually long or deeply nested brace expressions, especially if they correlate with HTTP 408, 429, 500, 502, 503, or 504 responses, request timeouts, elevated CPU, event-loop lag, worker restarts, or container OOM/restart events. Focus on endpoints or workflows that accept file globs, include/exclude patterns, search masks, repository paths, archive filters, or build configuration. Compare suspicious activity against process metrics from APM, Kubernetes events, container runtime logs, and host telemetry to identify short periods of high CPU in node processes without corresponding traffic volume increases. For exposure detection, use SBOM and dependency scans to locate vulnerable brace-expansion versions in application bundles and container images.

What your security team should do

• Inventory all JavaScript, Node.js, container, and CI/CD artifacts for affected brace-expansion versions, including transitive dependencies.
• Prioritize remediation for internet-facing services, authenticated multi-tenant features, developer portals, build systems, and APIs that accept user-controlled glob, brace, or path-pattern input.
• Upgrade to brace-expansion 1.1.12, 2.0.2, 3.0.1, or 4.0.1, and upgrade Chainguard kapp-fips to 0.64.0-r1 or later where present.
• Regenerate lockfiles and rebuild containers or serverless packages to ensure vulnerable nested copies are removed.
• Add input length limits, expansion limits, request timeouts, and rate limits around any feature that processes user-provided pattern syntax.
• Search historical logs for abnormal bursts of complex brace-pattern inputs correlated with CPU spikes, timeouts, or Node.js event-loop lag.
• Treat this as a moderate-priority availability issue rather than an emergency remote-code-execution event, unless exposed business-critical services process untrusted patterns at scale.