The brace-expansion library up to version 5.0.6 contains an exponential‑time algorithm in the expand() function when handling consecutive non‑expanding brace groups. When supplied with a crafted string, the function can consume disproportionate CPU time and block the event loop, resulting in service unavailability. This flaw is identified as CWE‑1333, CWE‑400 and CWE‑407.

Affected has the npm package brace‑expansion, version 5.0.6 and earlier. The vulnerability specifically impacts applications that use the expand() method directly or indirectly. No other vendors or products are listed.

The CVSS score is 7.7, indicating high severity. EPSS score of < 1% indicates a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV, and can be triggered by passing a malicious string to expand(); this can be done via any input path that invokes the library, such as user‑supplied data in web applications, command‑line tools, or automated pipelines. The max option offered by the library does not mitigate the recursion work performed. Without a patch, the exploitation can lead to CPU exhaustion and eventual denial of service for the affected application. The distinct weakness aligns with CWE‑1333 (key limit validation), in addition to CWE‑400 and CWE‑407.