Infinite loop Affecting brace-expansion package, versions <1.1.13>=2.0.0 <2.0.3>=3.0.0 <3.0.2>=4.0.0 <5.0.5
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-BRACEEXPANSION-15789759
- published27 Mar 2026
- disclosed26 Mar 2026
- creditSubhash Dasyam
Introduced: 26 Mar 2026
NewCVE-2026-33750 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade brace-expansion to version 1.1.13, 2.0.3, 3.0.2, 5.0.5 or higher.
Overview
brace-expansion is a Brace expansion as known from sh/bash
Affected versions of this package are vulnerable to Infinite loop through the expand function when processing a brace pattern with a zero step value. An attacker can cause the process to hang and exhaust system memory by supplying specially crafted input, such as {1..2..0}. This can lead to significant resource consumption and denial of service.
Workaround
This vulnerability can be mitigated by sanitizing strings passed to expand to ensure a step value of 0 is not used.