CVE-2026-33750 brace-expansion: Zero-step sequence causes process hang and memory exhaustion
An attacker can cause a denial of service by providing a brace pattern with a zero step value, leading to infinite loops and memory exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33750?
CVE-2026-33750 is a medium-severity denial of service vulnerability in juliangruber brace-expansion, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.
Weakness: CWE-400
Which versions are affected by CVE-2026-33750?
8 open source packages ship an affected version, including brace-expansion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
brace-expansion npm | All versions | 1.1.13 |
brace-expansion npm | All versions | 1.1.13 |
brace-expansion npm | From 2.0.0 | 2.0.3 |
brace-expansion npm | From 2.0.0 | 2.0.3 |
brace-expansion npm | From 3.0.0 | 3.0.2 |
brace-expansion npm | From 3.0.0 | 3.0.2 |
2 more packages
brace-expansion npm | From 4.0.0 | 5.0.5 |
brace-expansion npm | From 4.0.0 | 5.0.5 |
Products include Juliangruber Brace-Expansion.
How do I fix CVE-2026-33750?
Upgrade brace-expansion to a fixed version for your release line: 1.1.13, 2.0.3, 3.0.2 or 5.0.5.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33750 being exploited?
There is no known exploitation of CVE-2026-33750 in the wild and no public exploit code.
Other vulnerabilities in juliangruber brace-expansion
- CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
- CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection
Sources
Also known as AZL-81075, AZL-81084, CLEANSTART-2026-AE30126, CLEANSTART-2026-BZ46705, CLEANSTART-2026-CI27531, CLEANSTART-2026-GK81130 and 48 more.