CVE-2026-25547

Name of the Vulnerable Software and Affected Versions @isaacs/brace-expansion versions prior to 5.0.1

Description @isaacs/brace-expansion, a hybrid CJS/ESM TypeScript fork of brace-expansion, is subject to a denial of service (DoS) issue. This occurs due to unbounded brace range expansion when processing patterns with repeated numeric brace ranges. The library attempts to generate all possible combinations synchronously, leading to excessive CPU and memory consumption, potentially crashing the Node.js process.

Recommendations Update @isaacs/brace-expansion to version 5.0.1 or later.