The brace-expansion module builds strings using patterns that contain braces to generate combinatorial results. Prior to releases 1.1.20, 2.1.6, 3.0.8, and 5.0.11 the internal expand algorithm recurses once for each level of nested braces during comma‑member and single‑set expansions. When a malicious input contains deeply nested braces, this uncontrolled recursion can deplete the native call stack before any output size limits are enforced, causing the Node.js process to terminate. The vulnerability directly maps to resource exhaustion (CWE‑400), unchecked recursion limits (CWE‑674), and stack overflow (CWE‑770). Its CVSS score of 7.5 indicates a medium‑to‑high severity denial of service.

The brace‑expansion package released by juliangruber is vulnerable for all versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11. Node.js applications that import this module and accept user‑supplied strings containing brace syntax, such as command‑line utilities, build scripts, and web services, are at risk.

An attacker who can supply a crafted nested‑brace pattern to any call of expand() can trigger the recursion attack without any special privileges or authentication. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, but the straightforward attack vector and medium‑high CVSS rating mean that deployed applications that accept uncontrolled brace expressions should treat this as a significant risk.