Vulnerability	Vulnerable Version
H Infinite loop brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Infinite loop through the `expand` function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as `{1..2..0}`. This can lead to significant resource consumption and denial of service. How to fix Infinite loop? Upgrade `brace-expansion` to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.	<1.1.13>=2.0.0 <2.0.3>=3.0.0 <3.0.2>=4.0.0 <5.0.5
L Regular Expression Denial of Service (ReDoS) brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the `expand()` function, which is prone to catastrophic backtracking on very long malicious inputs. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `brace-expansion` to version 1.1.12, 2.0.2, 3.0.1, 4.0.1 or higher.	>=1.0.0 <1.1.12>=2.0.0 <2.0.2>=3.0.0 <3.0.1>=4.0.0 <4.0.1

Infinite loop

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Infinite loop through the expand function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as {1..2..0}. This can lead to significant resource consumption and denial of service.

How to fix Infinite loop?

Upgrade brace-expansion to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.

<1.1.13>=2.0.0 <2.0.3>=3.0.0 <3.0.2>=4.0.0 <5.0.5

Regular Expression Denial of Service (ReDoS)

brace-expansion is a Brace expansion as known from sh/bash

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) in the expand() function, which is prone to catastrophic backtracking on very long malicious inputs.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade brace-expansion to version 1.1.12, 2.0.2, 3.0.1, 4.0.1 or higher.

>=1.0.0 <1.1.12>=2.0.0 <2.0.2>=3.0.0 <3.0.1>=4.0.0 <4.0.1

Go back to all versions of this package