CVE-2026-25547 Uncontrolled Resource Consumption in @isaacs/brace-expansion
Attackers can cause denial of service in applications using @isaacs/brace-expansion by submitting patterns that trigger exponential resource consumption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25547?
CVE-2026-25547 is a critical denial of service vulnerability in isaacs brace-expansion, published on 4 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
Weakness: CWE-1333
Which versions are affected by CVE-2026-25547?
2 open source packages ship an affected version, including @isaacs/brace-expansion.
| Package | Affected | Fixed in |
|---|---|---|
@isaacs/brace-expansion npm | All versions | 5.0.1 |
@isaacs/brace-expansion npm | All versions | 5.0.1 |
Linux distribution packages (11)
openQA openSUSE:Leap 16.0 | All versions | 5.1771422749.560a3b26-bp160.1.1 |
os-autoinst openSUSE:Leap 16.0 | All versions | 5.1771353921.c8005c9-bp160.1.1 |
cockpit openSUSE:Tumbleweed | All versions | 356-2.1 |
cockpit-machines openSUSE:Tumbleweed | All versions | 348-1.1 |
cockpit-packages openSUSE:Tumbleweed | All versions | 4.1-4.1 |
cockpit-podman openSUSE:Tumbleweed | All versions | 120-2.1 |
cockpit-repos openSUSE:Tumbleweed | All versions | 4.7-4.1 |
cockpit-subscriptions openSUSE:Tumbleweed | All versions | 14.4-4.1 |
cockpit-tukit openSUSE:Tumbleweed | All versions | 0.1.7~git0.61e54f1-3.1 |
openQA openSUSE:Tumbleweed | All versions | 5.1770718745.ce2072d3-1.1 |
python-jupyter-ydoc openSUSE:Tumbleweed | All versions | 3.4.0-2.1 |
How do I fix CVE-2026-25547?
Upgrade @isaacs/brace-expansion to 5.0.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25547 being exploited?
There is no known exploitation of CVE-2026-25547 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-RL65112, CLEANSTART-2026-UE38963, DEBIAN-CVE-2026-25547, ECHO-0199-0689-e425, GHSA-7h2j-956f-4vf2, MINI-3w7w-j3qj-4gc2 and 18 more.