The brace-expansion library contains a flaw in its parseCommaParts function that, when fed deeply nested or very large brace patterns, triggers uncontrolled recursion and large argument array expansion, a classic case of resource exhaustion. The excessive recursion leads to stack depth overflow, while the unbounded array expansion can exhaust system memory. This causes the Node.js process’s native call stack to overflow before any limit can be applied, resulting in process termination and a denial‑of‑service of the affected application.

The vulnerability affects the open‑source brace‑expansion library maintained by juliangruber. Versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10 are impacted. Any Node.js application that imports this library during runtime could be exposed.

The CVSS score of 7.5 indicates a high severity risk, and the EPSS score is < 1%, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could trigger the DoS by supplying crafted brace patterns through any interface that passes user input to the library. The impact is local to the host running the Node.js process; there is no remote code execution or privilege escalation threat. If the library is used in a publicly exposed service, the denial of service could affect availability for all users of that service.