Security: brace-expansion DoS via exponential expansion — not covered in #231

[LucasMaupin]

Summary

brace-expansion (lockfile has 1.1.12, vulnerable range <=1.1.16) allows an attacker to cause a Denial of Service through exponential or zero-step brace expansion patterns. This is distinct from the minimatch/picomatch/glob vulnerabilities tracked in #231 — brace-expansion is a dependency of those packages and has its own independent CVE.

Vulnerability Details

• Package: brace-expansion
• Vulnerable ranges:
  • <=1.1.16 (lockfile: 1.1.12)
  • 2.0.0–2.1.2 (lockfile: may also be present)
• Fixed in: >=1.1.17, >=2.1.3
• Severity: High (CVSS 7.5 for exponential expansion, CVSS 6.5 for zero-step hang)
• CVEs: Multiple
• Types:
  1. Zero-step sequence ({0..X..0}) causes process hang / memory exhaustion
  2. Exponential expansion ({a,b,c,d,...} deeply nested) causes CPU/memory DoS
• Dependency path: minimatch → brace-expansion, glob → brace-expansion

Risk

If any code path passes user-controlled strings into functions using brace-expansion (e.g., glob patterns derived from user input, filename matching), an attacker can crash the process or cause excessive CPU load.

Recommendation

Update parent packages to pull in a fixed brace-expansion:

npm install minimatch@latest glob@latest
npm audit fix

Verify:

npm ls brace-expansion
npm audit --audit-level=high

Related Issues

• Security: High-severity npm vulnerabilities in transitive deps — flatted, lodash, minimatch, picomatch, glob #231 — sibling vulnerabilities in minimatch, picomatch, glob, lodash, flatted
• Security: Run npm audit fix to address 7 high + 8 moderate dependency vulnerabilities #227 — umbrella npm audit fix