GHSA-f886-m6hf-6m8v
Medium · 6.5CVSS
6.5
EPSS
—
Published
Mar 26, 2026
CISA due date
—
The record
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | brace-expansion | 0 | 1.1.13 |
| npm | brace-expansion | 2.0.0 | 2.0.3 |
| npm | brace-expansion | 3.0.0 | 3.0.2 |
| Chainguard | arangodb-3.12 | 0 | 3.12.7.2-r5 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.19-r5 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Chainguard | eslint | 0 | 10.1.0-r1 |
| Chainguard | gemini-cli | 0 | 0.35.3-r0 |
| Chainguard | kibana-7 | 0 | 7.17.29-r8 |
| Chainguard | kubeflow-centraldashboard | 0 | 1.10.0-r18 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r20 |
| Chainguard | lerna | 0 | 9.0.7-r2 |
| Chainguard | npm | 0 | 11.12.1-r0 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.5-r6 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r6 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.5-r5 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.5-r5 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r8 |
| Chainguard | opensearch-dashboards-3-fips-alerting-dashboards-plugin | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-maps | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-notifications | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-observability | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-query-workbench | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-reporting | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-dashboards-search-relevance | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-index-management-dashboards-plugin | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-ml-commons-dashboards | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-security-analytics-dashboards-plugin | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-fips-security-dashboards-plugin | 0 | 3.5.0-r7 |
| Chainguard | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r13 |
| Chainguard | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r13 |
| Chainguard | pelias-api | 0 | 7.6.0-r5 |
| Chainguard | prism | 0 | 5.14.3-r13 |
| Chainguard | pulumi-language-nodejs | 0 | 3.229.0-r3 |
| Chainguard | rancher-api-ui | 0 | 1.2.3-r8 |
| Chainguard | redisinsight | 0 | 3.2.0-r4 |
| Chainguard | renovate | 0 | 43.104.7-r1 |
| Chainguard | serve | 0 | 14.2.6-r1 |
| Chainguard | sqlpad | 0 | 7.5.7-r17 |
| Chainguard | tileserver-gl | 0 | 5.5.0-r11 |
| Chainguard | tileserver-gl-fips | 0 | 5.5.0-r11 |
| Chainguard | wazuh-dashboard | 0 | 4.14.4-r1 |
| Chainguard | wazuh-dashboard-dashboards-reporting | 0 | 4.14.4-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Wolfi | eslint | 0 | 10.1.0-r1 |
| Wolfi | kubeflow-centraldashboard | 0 | 1.10.0-r18 |
| Wolfi | lerna | 0 | 9.0.7-r2 |
| Wolfi | npm | 0 | 11.12.1-r0 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.5-r6 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.5-r6 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-alerting-dashboards-plugin | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-anomaly-detection-dashboards-plugin | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-maps | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-notifications | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-observability | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-query-workbench | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-reporting | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-dashboards-search-relevance | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-index-management-dashboards-plugin | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-ml-commons-dashboards | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-security-analytics-dashboards-plugin | 0 | 3.5.0-r13 |
| Wolfi | opensearch-dashboards-3-security-dashboards-plugin | 0 | 3.5.0-r13 |
| Wolfi | prism | 0 | 5.14.3-r13 |
| Wolfi | pulumi-language-nodejs | 0 | 3.229.0-r3 |
| Wolfi | rancher-api-ui | 0 | 1.2.3-r8 |
| Wolfi | renovate | 0 | 43.104.7-r1 |
| Wolfi | serve | 0 | 14.2.6-r1 |
| Wolfi | sqlpad | 0 | 7.5.7-r17 |
| Wolfi | tileserver-gl | 0 | 5.5.0-r11 |
Related vulnerabilities
- CVE-2026-33750 The brace-expansion library generates arbitrary strings containing a common prefix and… Same vulnerability
- CVE-2026-45149 The brace-expansion library generates arbitrary strings containing a common prefix and… Also affects brace-expansion
- GHSA-jxxr-4gwj-5jf2 brace-expansion: Large numeric range defeats documented `max` DoS protection Also affects brace-expansion
- CVE-2025-5889 A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. Also affects brace-expansion
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects arangodb-3.12
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects arangodb-3.12
- GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent… Also affects arangodb-3.12
- GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular… Also affects arangodb-3.12