CVE-2026-33750

npm/brace-expansion CVE-2026-33750: medium 6.5, EPSS 0.61%

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Action: Upgrade brace-expansion to 1.1.13 or later.

npm i brace-expansion@5.0.5

npm i brace-expansion@3.0.2

npm i brace-expansion@2.0.3

npm i brace-expansion@1.1.13

Affected

Fixed versions

Sources

• osv: GHSA-f886-m6hf-6m8v
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750
• https://github.com/juliangruber/brace-expansion/issues/98
• https://github.com/juliangruber/brace-expansion/pull/95
• https://github.com/juliangruber/brace-expansion/pull/96
• https://github.com/juliangruber/brace-expansion/pull/97
• https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
• https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
• https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
• https://github.com/juliangruber/brace-expansion
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

CVE-2026-33750 · published 2026-03-26T18:29:42Z · modified 2026-09-10T03:51:00.342356761Z · JSON