VYPR
← All advisories
Low severity3.1NVD Advisory· Published Jun 9, 2025· Updated Apr 29, 2026

CVE-2025-5889

CVE-2025-5889

Description

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
brace-expansionnpm
>= 2.0.0, < 2.0.22.0.2
brace-expansionnpm
>= 1.0.0, < 1.1.121.1.12
brace-expansionnpm
>= 3.0.0, < 3.0.13.0.1
brace-expansionnpm
>= 4.0.0, < 4.0.14.0.1

Patches

5
c85b8ad3f53d

4.0.1

https://github.com/juliangruber/brace-expansionJulian GruberJun 11, 2025via osv
commit
2 files changed · +3 −3
  • package.json+1 −1 modified
    @@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "repository": {
     "type": "git",
     "url": "git://github.com/juliangruber/brace-expansion.git"
  • package-lock.json+2 −2 modified
    @@ -1,12 +1,12 @@
 {
   "name": "brace-expansion",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "brace-expansion",
-      "version": "4.0.0",
+      "version": "4.0.1",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^3.0.0"
36603d5f3599

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)

https://github.com/juliangruber/brace-expansionmmmsssttt404Jun 11, 2025via ghsa
commit
2 files changed · +16 −1
  • index.js+1 −1 modified
    @@ -116,7 +116,7 @@ function expand(str, isTop) {
     var isOptions = m.body.indexOf(',') >= 0;
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,.*\}/)) {
+      if (m.post.match(/,(?!,).*\}/)) {
         str = m.pre + '{' + m.body + escClose + m.post;
         return expand(str);
       }
  • test/redos.js+15 −0 added
    @@ -0,0 +1,15 @@
+import test from 'node:test'
+import assert from 'assert'
+import expand from '../index.js'
+
+test('redos', function () {
+let str = "{a}" + ",".repeat(100000) + "\u0000";
+    let startTime = performance.now();
+    expand(str)
+    let endTime = performance.now();
+    let timeTaken = endTime - startTime;
+    assert.ok(timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`);
+})
+
+
+
15f9b3c75ebf

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)

https://github.com/juliangruber/brace-expansionmmmsssttt404Jun 11, 2025via ghsa
commit
2 files changed · +16 −1
  • index.js+1 −1 modified
    @@ -144,7 +144,7 @@ function expand (str, isTop) {
     const isOptions = m.body.indexOf(',') >= 0
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,.*\}/)) {
+      if (m.post.match(/,(?!,).*\}/)) {
         str = m.pre + '{' + m.body + escClose + m.post
         return expand(str)
       }
  • test/redos.js+15 −0 added
    @@ -0,0 +1,15 @@
+import test from 'node:test'
+import assert from 'assert'
+import expand from '../index.js'
+
+test('redos', function () {
+let str = "{a}" + ",".repeat(100000) + "\u0000";
+    let startTime = performance.now();
+    expand(str)
+    let endTime = performance.now();
+    let timeTaken = endTime - startTime;
+    assert.ok(timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`);
+})
+
+
+
c3c73c8b088d

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)

https://github.com/juliangruber/brace-expansionmmmsssttt404Jun 11, 2025via ghsa
commit
2 files changed · +16 −1
  • index.js+1 −1 modified
    @@ -109,7 +109,7 @@ function expand(str, isTop) {
   var isOptions = m.body.indexOf(',') >= 0;
   if (!isSequence && !isOptions) {
     // {a},b}
-    if (m.post.match(/,.*\}/)) {
+    if (m.post.match(/,(?!,).*\}/)) {
       str = m.pre + '{' + m.body + escClose + m.post;
       return expand(str);
     }
  • test/redos.js+15 −0 added
    @@ -0,0 +1,15 @@
+import test from 'node:test'
+import assert from 'assert'
+import expand from '../index.js'
+
+test('redos', function () {
+let str = "{a}" + ",".repeat(100000) + "\u0000";
+    let startTime = performance.now();
+    expand(str)
+    let endTime = performance.now();
+    let timeTaken = endTime - startTime;
+    assert.ok(timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`);
+})
+
+
+
0b6a9781e18e

Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65)

https://github.com/juliangruber/brace-expansionmmmsssttt404Jun 11, 2025via ghsa
commit
2 files changed · +16 −1
  • index.js+1 −1 modified
    @@ -154,7 +154,7 @@ function expand (str, isTop) {
     const isOptions = m.body.indexOf(',') >= 0
     if (!isSequence && !isOptions) {
       // {a},b}
-      if (m.post.match(/,.*\}/)) {
+      if (m.post.match(/,(?!,).*\}/)) {
         str = m.pre + '{' + m.body + escClose + m.post
         return expand(str)
       }
  • test/redos.js+15 −0 added
    @@ -0,0 +1,15 @@
+import test from 'node:test'
+import assert from 'assert'
+import expand from '../index.js'
+
+test('redos', function () {
+let str = "{a}" + ",".repeat(100000) + "\u0000";
+    let startTime = performance.now();
+    expand(str)
+    let endTime = performance.now();
+    let timeTaken = endTime - startTime;
+    assert.ok(timeTaken < 1000, `Expected time (${timeTaken}ms) to be less than 1000ms`);
+})
+
+
+

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.