[GHSA-mh99-v99m-4gvg] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

[litmaj0r]

Updates

• Affected products

Comments
The maintainers have backported this fix to the 1.x, 2.x and 3.x maintenance lines (npm dist-tags maintenance-v1 / maintenance-v2 / maintenance-v3) since this advisory was published. The current single range (introduced 0, fixed 5.0.8) reports those patched releases as vulnerable. First fixed per line: 1.1.17 (2026-07-29), 2.1.3 (2026-07-28), 3.0.3 (2026-07-27), 5.0.8 (2026-07-23). The 4.x line has received no backport (last release 4.0.1, 2025-06-11) and remains affected, so it stays inside the range closing at 5.0.8. Verification method: the fix bounds total accumulated output characters via a new maxLength option (EXPANSION_MAX_LENGTH, default 4000000). I installed each version from the registry into an isolated tree and compared chars(expand(input)) against chars(expand(input, {maxLength: 1000})) for input = '{a,b}'.repeat(N). Patched builds truncate; pre-fix builds ignore the option and return the full result set. Results: 1.1.16 ignores maxLength and OOM-crashed the process at N=25, reproducing the PoC, while 1.1.17 truncated 2500000 chars to 1000. Same pattern for 2.1.2 vs 2.1.3, and 3.0.2 vs 3.0.3. 4.0.1 ignores maxLength. Corroborated at source level: EXPANSION_MAX_LENGTH and the maxLength option are present in index.js of 1.1.17+, 2.1.3+ and 3.0.3+, and absent from 1.1.16, 2.1.2, 3.0.2 and 4.0.1. This distinction matters beyond range accuracy: 5.x changed the module's export shape (module.exports = expand became a named expand binding), so forcing 5.x onto CJS consumers such as minimatch@3 breaks them at runtime with 'TypeError: expand is not a function'. The 1.x and 2.x backports deliberately preserve module.exports = expandTop, making them the only viable remediation for those consumers - which the current range implies do not exist. (3.x and 4.x are pure ESM; 5.0.9 does not restore a default export.)

[github]

Hi there @juliangruber! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[G-Rath]

This is a duplicate of #8832