The vulnerability of the expand() function in the juliangruber/brace-expansion library of the Node.js software platform allows a malicious actor to cause a service failure.

🗓️ 11 Feb 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Uncontrolled resource consumption in expand() of juliangruber brace expansion can cause service failures.

Reporter	Title	Published	Views	Family All 166
IBM Security Bulletins	Security Bulletin: Carbon design system packages	18 Aug 202519:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205.	6 Apr 202618:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to a denial of service	4 Mar 202605:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	16 Feb 202609:23	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	16 Oct 202507:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.	29 Dec 202503:28	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in brace-expansion, tmp, urllib3, pycryptodomex and cross-site request forgery might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	12 Dec 202513:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Data Collector uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.	29 Dec 202503:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses brace-expansion-2.0.1.tgz which is vulnerable to this CVE-2025-5889	9 Oct 202512:12	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in juliangruber affects IBM watsonx Orchestrate with watsonx Assistant Cartridge	22 Jan 202605:05	–	ibm

Vulners

Node

node.js node.jsMatch20.20.0

Source	Link
github	www.github.com/juliangruber/brace-expansion/releases/tag/v4.0.1
github	www.github.com/juliangruber/brace-expansion/pull/65/commits/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5
gist	www.gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
redos	www.redos.red-soft.ru/search/
web	www.web.nvd.nist.gov/view/vuln/detail

08 Apr 2026 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 22.1

CVSS 33.1

EPSS0.00459

brace expansion expand function juliangruber brace expansion resource exhaustion service failures