CVE Explorer
CVE-2026-33750
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"brace-expansion","vendor":"juliangruber","versions":[{"status":"affected","version":">= 4.0.0, < 5.0.5"},{"status":"affected","version":">= 3.0.0, < 3.0.2"},{"status":"affected","version":">= 2.0.0, < 2.0.3"},{"status":"affected","version":"< 1.1.13"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-400","description":"CWE-400: Uncontrolled Resource Consumption","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/problemTypes/0/descriptions/0
Source references
10 source assertions{"name":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/8
{"name":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/9
{"name":"https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/5
{"name":"https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/6
{"name":"https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/7
{"name":"https://github.com/juliangruber/brace-expansion/issues/98","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/issues/98"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/1
{"name":"https://github.com/juliangruber/brace-expansion/pull/95","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/pull/95"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/2
{"name":"https://github.com/juliangruber/brace-expansion/pull/96","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/pull/96"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/3
{"name":"https://github.com/juliangruber/brace-expansion/pull/97","tags":["x_refsource_MISC"],"url":"https://github.com/juliangruber/brace-expansion/pull/97"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/4
{"name":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","tags":["x_refsource_CONFIRM"],"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7bb92d001b29e6a835441260683213308502786721065796a6a59ff7690226fa · sha256:8107da3127e59159… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.