An open index of dependabot pull requests across open source projects.

brace-expansion

Ecosystem:
npm
Package URL:
pkg:npm/brace-expansion
Total PRs:
30,451 Dependabot PRs
Latest PR:
about 3 hours ago
Unique Repositories:
26,713 repositories
Unique Repos (30 days):
509 repositories
Security Advisories
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
GHSA-rgw5-rvv9-x895 CVE-2026-69152 HIGH published about 2 months ago • updated 1 day ago
### Summary The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where re...
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
GHSA-mh99-v99m-4gvg CVE-2026-14257 HIGH published 2 months ago • updated 1 day ago
### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining man...
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
GHSA-3jxr-9vmj-r5cp CVE-2026-13149 HIGH published 2 months ago • updated 10 days ago
### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, ...
ReDoS in brace-expansion
GHSA-832h-xg76-4gv6 CVE-2017-18077 HIGH published over 8 years ago • updated about 2 hours ago
Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition. ## Proof of Concept ``` var expand = r...
brace-expansion: Zero-step sequence causes process hang and memory exhaustion
GHSA-f886-m6hf-6m8v CVE-2026-33750 MODERATE published 6 months ago • updated 8 days ago
### Impact A brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process ...
Recent PRs
Package Details
Name: brace-expansion
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/brace-expansion
JSON API: View JSON
Security Advisories

7

Active advisories
HIGH 4
MODERATE 2
LOW 1
View All npm Advisories
Package Information
Description:

Brace expansion as known from sh/bash

Repository: https://github.com/juliangruber/brace-expansion
Homepage: https://github.com/juliangruber/brace-expansion
Latest Release: 4.0.0
over 2 years ago
Dependent Repos: 1,303,119
Dependent Packages: 2,652
Downloads: 876,805,460
Ranking: Top 0.027% by dependent repos Top 0.0007% by downloads Top 0.0304% by dependent pkgs
PR Status
Open 18,634 (61.2%)
Merged 6,151 (20.2%)
Closed 5,666 (18.6%)
PR Types
Major 756 (2.5%)
Minor 181 (0.6%)
Patch 29,428 (96.6%)
Removal 13 (0.0%)