GHSA-7h2j-956f-4vf2
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
@isaacs/brace-expansion has Uncontrolled Resource Consumption
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @isaacs/brace-expansion | 0 | 5.0.1 |
| Chainguard | actions-runner | 0 | 2.331.0-r3 |
| Chainguard | lerna | 0 | 9.0.3-r3 |
| Chainguard | librechat | 0 | 0.8.2-r1 |
| Chainguard | node-gyp | 0 | 12.2.0-r2 |
| Chainguard | npm | 0 | 11.9.0-r0 |
| Chainguard | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Chainguard | renovate | 0 | 43.3.1-r0 |
| Chainguard | sqlpad | 0 | 7.5.7-r8 |
| Wolfi | lerna | 0 | 9.0.3-r3 |
| Wolfi | node-gyp | 0 | 12.2.0-r2 |
| Wolfi | npm | 0 | 11.9.0-r0 |
| Wolfi | pulumi-language-nodejs | 0 | 3.217.1-r2 |
| Wolfi | renovate | 0 | 43.3.1-r0 |
| Wolfi | sqlpad | 0 | 7.5.7-r8 |
Related vulnerabilities
- CVE-2026-25547 @isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Same vulnerability
- GHSA-9ppj-qmqm-q256 node-tar Symlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- CVE-2026-31802 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- CVE-2026-29786 node-tar is a full-featured Tar for Node.js. Also affects actions-runner
- GHSA-qffp-2rhf-9h96 tar has Hardlink Path Traversal via Drive-Relative Linkpath Also affects actions-runner
- GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent… Also affects actions-runner
- GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular… Also affects actions-runner
- CVE-2026-27903 minimatch is a minimal matching utility for converting glob expressions into JavaScript… Also affects actions-runner