brace-expansion npm Package: Potential DoS via Exponential-Time Expansion
The brace-expansion npm package is under investigation for exhibiting exponential-time behavior in the number of consecutive non-expanding {} groups, which could lead to potential Denial of Service (DoS) attacks. Users of affected versions should monitor for potential DoS attacks and consider implementing input validation or limiting the number of groups in inputs passed to brace-expansion.expand().
What happened
Reportedly, the brace-expansion npm package shows exponential-time behavior when processing a specific pattern of input: consecutive non-expanding {} groups. This behavior can cause the calling thread to block for an extended period, effectively denying service. A short input can block the thread for minutes, making it a potential vector for DoS attacks.
The issue appears to affect multiple versions of the brace-expansion package. The affected versions and their corresponding fixed versions are as follows: {'introduced': '3.0.0', 'fixed': '5.0.7'}, {'introduced': '0', 'fixed': '1.1.16'}, {'introduced': '2.0.0', 'fixed': '2.1.2'}, {'introduced': '0', 'fixed': '1.1.7'}, {'introduced': '4.0.0', 'fixed': '5.0.5'}, {'introduced': '3.0.0', 'fixed': '3.0.2'}, {'introduced': '2.0.0', 'fixed': '2.0.3'}, {'introduced': '0', 'fixed': '1.1.13'}, {'introduced': '5.0.0', 'fixed': '5.0.6'}, {'introduced': '2.0.0', 'fixed': '2.0.2'}, {'introduced': '1.0.0', 'fixed': '1.1.12'}, {'introduced': '3.0.0', 'fixed': '3.0.1'}, {'introduced': '3.0.0', 'last_affected': '3.0.0'}, {'introduced': '4.0.0', 'fixed': '4.0.1'}, {'introduced': '4.0.0', 'last_affected': '4.0.0'}.
To assess your exposure, check if your project dependencies include any of the affected versions of the brace-expansion package. If so, consider updating to the fixed versions or implementing input validation to mitigate the risk of DoS attacks. For more detailed information, consult the primary source: [GHSA-3jxr-9vmj-r5cp] brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups.
How 0Day mitigates this
brace-expansion is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.