CVE-2026-25547
NoneCVSS
—
EPSS
0.5%
Published
Feb 4, 2026
CISA due date
—
The record
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @isaacs/brace-expansion | 0 | 5.0.1 |
| Chainguard | actions-runner | 0 | 2.331.0-r3 |
| Chainguard | lerna | 0 | 9.0.3-r3 |
| Chainguard | librechat | 0 | 0.8.2-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r2 |
| Chainguard | npm | 0 | 11.9.0-r0 |
| Chainguard | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Chainguard | renovate | 0 | 43.3.1-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r8 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-alertmanager | 0 | 0.28.1-150100.4.31.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-prometheus | 0 | 3.5.0-150100.4.29.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| SUSE:Linux Enterprise Server 15 SP4-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Server 15 SP5-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP5 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Manager Client Tools 15 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools 15 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools 15 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| SUSE:Manager Client Tools 15 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0 | 0.28.1-150100.4.31.1 |
| SUSE:Manager Client Tools 15 | golang-github-prometheus-prometheus | 0 | 3.5.0-150000.3.67.1 |
| SUSE:Manager Client Tools 15 | grafana | 0 | 11.6.11-150000.1.90.1 |
| SUSE:Manager Client Tools 15 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools 15 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| SUSE:Manager Client Tools 15 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| SUSE:Manager Client Tools for SLE Micro 5 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| SUSE:Manager Client Tools for SLE Micro 5 | uyuni-tools | 0 | 0.1.38-150000.1.30.1 |
| Wolfi | lerna | 0 | 9.0.3-r3 |
| Wolfi | node-gyp | 0 | 12.2.0-r2 |
| Wolfi | npm | 0 | 11.9.0-r0 |
| Wolfi | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Wolfi | renovate | 0 | 43.3.1-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r8 |
| openSUSE:Leap 15.6 | dracut-saltboot | 0 | 1.1.0-150000.1.65.1 |
| openSUSE:Leap 15.6 | golang-github-QubitProducts-exporter_exporter | 0 | 0.4.0-150000.1.21.1 |
| openSUSE:Leap 15.6 | golang-github-boynux-squid_exporter | 0 | 1.13.0-150000.1.12.1 |
| openSUSE:Leap 15.6 | golang-github-lusitaniae-apache_exporter | 0 | 1.0.10-150000.1.26.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-alertmanager | 0 | 0.28.1-150100.4.31.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-node_exporter | 0 | 1.9.1-150100.3.38.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-prometheus | 0 | 3.5.0-150100.4.29.1 |
| openSUSE:Leap 15.6 | golang-github-prometheus-promu | 0 | 0.17.0-150000.3.30.1 |
| openSUSE:Leap 15.6 | prometheus-blackbox_exporter | 0 | 0.26.0-150000.1.30.2 |
| openSUSE:Leap 15.6 | spacecmd | 0 | 5.0.15-150000.3.142.1 |
| openSUSE:Leap 16.0 | cockpit | 0 | 354-160000.2.1 |
| openSUSE:Leap 16.0 | cockpit-machines | 0 | 346-160000.2.1 |
| openSUSE:Leap 16.0 | cockpit-podman | 0 | 117-160000.2.1 |
| openSUSE:Leap 16.0 | golang-github-prometheus-prometheus | 0 | 3.5.0-160000.2.1 |
| openSUSE:Leap 16.0 | openQA | 0 | 5.1771422749.560a3b26-bp160.1.1 |
| openSUSE:Leap 16.0 | os-autoinst | 0 | 5.1771353921.c8005c9-bp160.1.1 |
| openSUSE:Tumbleweed | cockpit | 0 | 356-2.1 |
| openSUSE:Tumbleweed | cockpit-machines | 0 | 348-1.1 |
| openSUSE:Tumbleweed | cockpit-packages | 0 | 4.1-4.1 |
| openSUSE:Tumbleweed | cockpit-podman | 0 | 120-2.1 |
| openSUSE:Tumbleweed | cockpit-repos | 0 | 4.7-4.1 |
| openSUSE:Tumbleweed | cockpit-subscriptions | 0 | 14.4-4.1 |
| openSUSE:Tumbleweed | cockpit-tukit | 0 | 0.1.7~git0.61e54f1-3.1 |
| openSUSE:Tumbleweed | heroic-games-launcher | 0 | 2.20.0-1.1 |
| openSUSE:Tumbleweed | openQA | 0 | 5.1770718745.ce2072d3-1.1 |
| openSUSE:Tumbleweed | python-bqplot | 0 | 0.12.45-14.1 |
| openSUSE:Tumbleweed | python-jupyter-ydoc | 0 | 3.4.0-2.1 |
Related vulnerabilities
- GHSA-7h2j-956f-4vf2 @isaacs/brace-expansion has Uncontrolled Resource Consumption Same vulnerability
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent… Also affects actions-runner
- GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular… Also affects actions-runner
- CVE-2026-27903 minimatch is a minimal matching utility for converting glob expressions into JavaScript… Also affects actions-runner