brace-expansion vulnerabilities

A vulnerability was found in the brace-expansion library up to versions 1.1.11, 2.0.1, 3.0.0, and 4.0.0, involving inefficient regular expression complexity in the expand function in index.js. The attack can be launched remotely.

The brace-expansion library prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9 contains a vulnerability where the expand() function does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the event loop.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales until the process hits a fatal out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000).

A vulnerability in brace-expansion up to version 5.0.6 allows a DoS attack by sending a crafted string with many consecutive non-expanding '{}' brace groups. The expand() function has exponential time complexity, causing high CPU consumption and event-loop blocking.

The brace-expansion library versions 5.0.0 to before 5.0.6 apply the max option too late, causing excessive memory (~505 MB) and CPU (~800 ms) usage when expanding large numeric ranges. Fixed in version 5.0.6.