CVE-2026-33750

What it actually does

The flaw is an uncontrolled resource consumption issue in the juliangruber brace-expansion library. When the library expands a numeric brace expression that uses a zero step value, such as `{1..2..0}`, sequence generation does not terminate as expected. Applications that pass attacker-controlled or untrusted strings to `expand()` can be forced into a long-running loop and excessive heap memory allocation, causing high CPU usage, memory exhaustion, event-loop blocking, process hangs, or process termination. The impact is availability loss only; the vulnerability does not directly provide code execution, data disclosure, or data modification.

Why it matters to the business

Applications, build tools, developer platforms, APIs, or services that use vulnerable versions of brace-expansion and process user-supplied patterns may be susceptible to denial of service. A small crafted input can degrade performance or make a service unavailable, potentially causing failed requests, job backlogs, degraded developer workflows, outages, and increased infrastructure costs from repeated crashes or autoscaling. The CVSS score is moderate-high for availability impact, but the current EPSS score is low and there is no CISA KEV listing or known ransomware association, so remediation should be prioritized based on whether untrusted input reaches this library.

How an attack unfolds

An attacker first identifies an application feature that accepts strings later processed by brace-expansion, such as file globbing, path expansion, pattern matching, search filters, template expansion, build configuration, package tooling, or API parameters. The attacker submits a crafted brace expression containing a zero step value, for example `{1..2..0}`. If the application uses a vulnerable version of brace-expansion and does not validate the input, the library enters a non-terminating or highly resource-intensive sequence generation path. This can block the application thread, consume large amounts of memory, trigger garbage collection pressure, exhaust container or process memory limits, and ultimately cause slow responses, timeouts, crashes, or service restarts. Repeated submissions can sustain a denial-of-service condition.

How to fix it

Upgrade the brace-expansion package to a fixed version appropriate for the major release line in use: 5.0.5 or later, 3.0.2 or later, 2.0.3 or later, or 1.1.13 or later. Regenerate lockfiles and redeploy all applications, containers, build images, serverless functions, and developer tooling that bundle the vulnerable dependency, including transitive dependency copies. If immediate upgrade is not possible, sanitize all strings before calling `expand()` and reject brace ranges with a zero step value. Input validation should block numeric range expressions where the third range component is `0`, including whitespace and signed-zero variants where applicable. Add request size limits, execution timeouts, memory limits, and rate limiting around features that process user-supplied patterns. Where feasible, avoid passing untrusted input to brace expansion entirely.

How to confirm the fix worked

Confirm dependency versions using package manager tooling and lockfile review. For Node.js projects, inspect `package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`, `pnpm-lock.yaml`, SBOMs, and dependency trees for `brace-expansion` versions earlier than 5.0.5, 3.0.2, 2.0.3, or 1.1.13. Run `npm ls brace-expansion`, `yarn why brace-expansion`, or `pnpm why brace-expansion` as appropriate. Validate that rebuilt artifacts and container images no longer contain vulnerable versions. Add a negative test that submits `{1..2..0}` and confirms the application rejects it quickly or handles it without elevated CPU/memory usage. Monitor runtime behavior during the test to ensure there is no process hang, heap growth, request timeout, or restart.

Typical attack path

1. Find an application endpoint, job processor, CLI workflow, or build/dependency tool that accepts user-controlled brace, glob, or pattern strings.
2. Submit a brace expansion pattern with a zero step value, such as `{1..2..0}` or a nested variant embedded inside otherwise valid input.
3. Trigger application code that passes the crafted string into `brace-expansion`'s `expand()` function.
4. Cause the vulnerable sequence generation loop to run indefinitely or allocate excessive heap memory.
5. Repeat requests or jobs to maintain high CPU and memory pressure, leading to hangs, timeouts, process crashes, or service unavailability.

How to detect it

To assess whether exploitation already occurred, review application access logs, API gateway logs, reverse proxy logs, WAF logs, job-submission records, CI/CD logs, and application error logs for brace range inputs containing a zero step value. Focus on requests or jobs that include patterns like `{number..number..0}` and occurred shortly before CPU saturation, heap out-of-memory errors, container OOM kills, event-loop stalls, request timeouts, HTTP 502/503/504 responses, worker crashes, or repeated process restarts. In Node.js environments, examine logs and crash artifacts for JavaScript heap exhaustion, fatal out-of-memory errors, garbage collection pressure, unresponsive workers, and supervisor restarts. Because no public exploit maturity or named threat actor activity is currently indicated, detections should focus on anomalous input patterns and availability symptoms rather than actor-specific infrastructure.

• {1..2..0}
• ..0}
• FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
• FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• JavaScript heap out of memory
• Allocation failed - JavaScript heap out of memory
• OOMKilled
• out of memory
• heap out of memory
• brace-expansion
• expand()

What your security team should do

• Inventory all applications, CI/CD tooling, containers, and developer utilities that include the `brace-expansion` dependency, including transitive use through globbing or file-matching packages.
• Prioritize remediation for internet-facing services, multi-tenant platforms, job queues, build systems, or APIs where untrusted users can submit pattern, path, glob, or template strings.
• Upgrade to fixed brace-expansion versions: 5.0.5+, 3.0.2+, 2.0.3+, or 1.1.13+, and verify lockfiles and deployed artifacts were actually rebuilt.
• Add input validation to reject zero-step brace ranges before calling expansion functions, even after patching, as a defense-in-depth control.
• Apply operational controls such as request rate limiting, payload limits, worker timeouts, memory limits, and process supervision for services that process user-controlled patterns.
• Search historical logs for crafted zero-step brace expansion inputs and correlate any matches with CPU spikes, memory exhaustion, process restarts, 5xx errors, or job failures.
• Create regression tests and SCA policies to prevent vulnerable brace-expansion versions from re-entering the software supply chain.