`brace-expansion`

Ecosystem:
npm

Package URL:
pkg:npm/brace-expansion

Total PRs:
30,271 Dependabot PRs

Latest PR:
about 8 hours ago

Unique Repositories:
26,564 repositories

Unique Repos (30 days):
466 repositories

Security Advisories

brace-expansion Regular Expression Denial of Service vulnerability

GHSA-v6h2-p8h4-qcjw CVE-2025-5889 LOW published over 1 year ago • updated 4 days ago

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue ...

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

GHSA-mh99-v99m-4gvg CVE-2026-14257 HIGH published about 2 months ago • updated 15 days ago

### Summary `expand()` bounds the *number* of results it produces (the `max` option, `100_000` by default) but not their *length*. By chaining man...

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

GHSA-f886-m6hf-6m8v CVE-2026-33750 MODERATE published 6 months ago • updated 11 days ago

### Impact A brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process ...

brace-expansion: Large numeric range defeats documented `max` DoS protection

GHSA-jxxr-4gwj-5jf2 CVE-2026-45149 MODERATE published 4 months ago • updated 1 day ago

The `max` option was being applied too late: When expanding a single large numeric range like `{1..10000000}`, the sequence generation loop genera...

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

GHSA-3jxr-9vmj-r5cp CVE-2026-13149 HIGH published about 2 months ago • updated about 9 hours ago

### Summary brace-expansion's expand() exhibits exponential-time - O(2ⁿ) - behavior in the number of consecutive non-expanding {} groups. A short, ...

View all 7 advisories

Recent PRs

RSS Feed

chore(deps): bump brace-expansion in /frontend

berbad/Skin-Ecommerce #3

1.1.15 → 1.1.20 Patch PR

Open about 8 hours ago 1 comment

Bump brace-expansion

washogren/auto-update-dependencies #37

5.0.6 → 5.0.10 Patch PR

Closed about 8 hours ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 16 updates

jeanjacquesaka1980/pr-monitor #62

1.1.14 → 1.1.18 Patch PR

Closed about 10 hours ago 1 comment

Bump brace-expansion from 1.1.11 to 1.1.18 in /frontend

ebrensi/heatflask #133

1.1.11 → 1.1.18 Patch PR

Closed about 12 hours ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 15 updates

Shargrove09/accomps #7

1.1.12 → 1.1.18 Patch PR

Open about 13 hours ago 1 comment

[release-4.20] maintenance: Bump the npm group with 227 updates

openshift/networking-console-plugin #508

1.1.14 → 1.1.18 Patch PR

Open about 14 hours ago 4 comments

[release-4.22] maintenance: Bump the npm group with 249 updates

openshift/networking-console-plugin #507

1.1.14 → 1.1.18 Patch PR

Open about 14 hours ago 4 comments

[release-4.23] maintenance: Bump the npm group with 208 updates

openshift/networking-console-plugin #504

1.1.14 → 1.1.18 Patch PR

Open about 14 hours ago 4 comments

Bump the npm_and_yarn group across 1 directory with 11 updates

SharafatKarim/paste #4

1.1.12 → 1.1.18 Patch PR

Open about 14 hours ago 5 comments

chore(deps-dev): Bump brace-expansion from 1.1.11 to 1.1.18

conforma/policy-builder #64

1.1.11 → 1.1.18 Patch PR

Open about 16 hours ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

carriegale2710/tezgah #2

1.1.12 → 1.1.18 Patch PR

Open 1 day ago 1 comment

build(deps): bump brace-expansion from 2.1.1 to 2.1.4

PoolPartyLabs/pool-party-v2-frontend #18

2.1.1 → 2.1.4 Patch PR

Open 1 day ago 1 comment

build(deps-dev): bump brace-expansion from 1.1.12 to 1.1.18

strausmann/n8n-nodes-jmap-packet #2

1.1.12 → 1.1.18 Patch PR

Closed 1 day ago 1 comment

chore(deps): bump brace-expansion

tocoistas/caridade #46

1.1.12 → 1.1.18 Patch PR

Closed 1 day ago 2 comments

Bump brace-expansion from 1.1.12 to 1.1.18 in /docs

sinamics/ztnet #1015

1.1.12 → 1.1.18 Patch PR

Closed 1 day ago 1 comment

Bump brace-expansion from 1.1.11 to 1.1.18

SahilBamb/XeoReact #13

1.1.11 → 1.1.18 Patch PR

Closed 1 day ago 1 comment

Bump brace-expansion from 5.0.6 to 5.0.9

Avivmorad/InterviewPilot-AI #19

5.0.6 → 5.0.9 Patch PR

Open 1 day ago 2 comments

build(deps): bump the npm_and_yarn group across 1 directory with 6 updates

gandli/security-digest #5

1.1.12 → 1.1.18 Patch PR

Open 1 day ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

gandli/memorable-password-generator #4

2.0.2 → 2.1.4 Minor PR

Open 1 day ago 2 comments

Bump the npm_and_yarn group across 1 directory with 18 updates

prottushsui/cambrian-climate-club #83

1.1.12 → 1.1.18 Patch PR

Closed 1 day ago 1 comment

Bump the npm_and_yarn group across 1 directory with 13 updates

canstralian/MCPServerforRedTeamAgenticWorkflowszip #6

1.1.12 → 1.1.18 Patch PR

Open 1 day ago 5 comments

Bump the npm_and_yarn group across 1 directory with 10 updates

KryssNa/utilbyte #21

1.1.14 → 1.1.18 Patch PR

Open 2 days ago 1 comment

Bump brace-expansion

GlotPress/GlotPress #2113

2.1.1 → 2.1.4 Patch PR

Closed 2 days ago 1 comment

Bump brace-expansion from 1.1.8 to 1.1.18

wokoci/js30 #4

1.1.8 → 1.1.18 Patch PR

Closed 2 days ago 1 comment

fix(deps): bump brace-expansion from 1.1.11 to 1.1.18 in /e2e/assets/frontend

brandocms/brando #2816

1.1.11 → 1.1.18 Patch PR

Closed 2 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates

xJasonShane/IMG-cropping #11

2.0.2 → 2.1.4 Minor PR

Open 2 days ago 2 comments

chore(deps-dev): bump brace-expansion from 1.1.11 to 1.1.18

executiveusa/AVATAR #6

1.1.11 → 1.1.18 Patch PR

Open 2 days ago 2 comments

Bump brace-expansion

executiveusa/dispatchhelper #25

2.0.2 → 2.1.4 Minor PR

Open 2 days ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 12 updates

presiannedyalkov/eco-balance-documentation #558

2.1.1 → 2.1.4 Patch PR

Closed 2 days ago 1 comment

fix(deps): bump brace-expansion

elementary/action-appcenter-review-checklist #180

5.0.5 → 5.0.9 Patch PR

Closed 2 days ago 2 comments

chore(deps-dev): bump the npm_and_yarn group across 1 directory with 4 updates

ChrAu/feed2mastodon #471

1.1.12 → 1.1.18 Patch PR

Closed 2 days ago 1 comment

Bump brace-expansion from 1.1.12 to 1.1.18

executiveusa/auto-shop-turkey #9

1.1.12 → 1.1.18 Patch PR

Open 2 days ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 23 updates

milliorn/portfolio #310

1.1.14 → 1.1.18 Patch PR

Closed 2 days ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates

executiveusa/kupuri-soltar #6

1.1.15 → 1.1.18 Patch PR

Open 2 days ago 3 comments

build(deps): bump the npm_and_yarn group across 1 directory with 11 updates

executiveusa/Serbia-marketplace #8

1.1.12 → 1.1.18 Patch PR

Open 2 days ago 3 comments

Bump brace-expansion

executiveusa/emergent-wealth-culture #20

2.0.2 → 2.1.4 Minor PR

Open 2 days ago 2 comments

Bump brace-expansion

executiveusa/CLONELY-FANZ #17

2.0.2 → 2.1.4 Minor PR

Open 2 days ago 2 comments

Bump brace-expansion from 1.1.11 to 1.1.18

JaiminBrahmbhatt/meekaeng #52

1.1.11 → 1.1.18 Patch PR

Open 2 days ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates

JustAGhosT/home-lab-setup #49

1.1.12 → 1.1.18 Patch PR

Open 2 days ago 3 comments

chore(api)(deps): bump brace-expansion in /apps/api

JustAGhosT/pigpro #87

1.1.12 → 1.1.18 Patch PR

Open 2 days ago 4 comments

Bump brace-expansion from 1.1.11 to 1.1.18 in /themes/LoveIt-0.3.0

Maoxin1/mantou-blog #68

1.1.11 → 1.1.18 Patch PR

Closed 2 days ago 1 comment

Bump brace-expansion from 1.1.12 to 1.1.18

DrozmotiX/ioBroker.vedirect #915

1.1.12 → 1.1.18 Patch PR

Closed 2 days ago 1 comment

Bump the npm_and_yarn group across 1 directory with 20 updates

Tanker187/coinbase-onchain #2

2.0.1 → 2.1.4 Minor PR

Open 2 days ago 1 comment

build(deps): bump the npm_and_yarn group across 1 directory with 11 updates

franklinburrus/thefileswithdub #1

1.1.14 → 1.1.18 Patch PR

Closed 2 days ago 1 comment

Bump the npm_and_yarn group across 7 directories with 5 updates

AKJUS/swisstronik-tutorials #7

1.1.11 → 1.1.18 Patch PR

Open 2 days ago 1 comment

chore(deps): bump brace-expansion from 5.0.5 to 5.0.9

rhinos0608/Pi-SmartRead #10

5.0.5 → 5.0.9 Patch PR

Closed 2 days ago 2 comments

build(deps): bump the npm_and_yarn group across 1 directory with 5 updates

joeinus134131/idnmakerspace #2

5.0.6 → 5.0.9 Patch PR

Open 2 days ago 1 comment

chore(deps)(deps-dev): bump brace-expansion from 1.1.14 to 1.1.18 in /frontend

Killaret/knowledge-graph #72

1.1.14 → 1.1.18 Patch PR

Open 2 days ago 1 comment

Bump brace-expansion from 1.1.12 to 1.1.18

lucascaro/hexo-deployer-sftp #19

1.1.12 → 1.1.18 Patch PR

Closed 3 days ago 1 comment

chore(deps): bump brace-expansion in /frontend

claudiofxbr/PortalCursos.NG #68

1.1.14 → 1.1.18 Patch PR

Open 3 days ago 1 comment

Package Details

Name:	`brace-expansion`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/brace-expansion`
JSON API:	View JSON

Security Advisories

7

Active advisories

HIGH 4

MODERATE 2

LOW 1

View All npm Advisories

Package Information

Description:

Brace expansion as known from sh/bash

Repository:	https://github.com/juliangruber/brace-expansion
Homepage:	https://github.com/juliangruber/brace-expansion
Latest Release:	`4.0.0` over 2 years ago
Dependent Repos:	1,303,119
Dependent Packages:	2,652
Downloads:	876,805,460
Ranking:	Top 0.027% by dependent repos Top 0.0007% by downloads Top 0.0304% by dependent pkgs

PR Status

Open 18,555 (61.3%)

Merged 6,151 (20.3%)

Closed 5,565 (18.4%)

PR Types

Major 750 (2.5%)

Minor 170 (0.6%)

Patch 29,265 (96.7%)

Removal 13 (0.0%)