Brace‑expansion through version 5.0.7 is susceptible to a denial‑of‑service attack that exhausts memory. The expand() routine limits how many results it returns (default 100,000) but does not limit the length of each result. An attacker can construct a payload with multiple chained brace groups, keeping the result count under the hard limit while allowing each string to grow arbitrarily large. The total memory used scales with both the number of results and the length of each result, eventually causing the Node.js process to terminate with an unavoidable out‑of‑memory error. Roughly 7.5 KB of crafted input is sufficient to crash a default Node.js process. Any application that passes attacker‑controlled strings to brace‑expansion.expand(), intentionally or indirectly through minimatch or glob patterns, can be taken down with a small request.

The vulnerability affects the Node.js package "brace‑expansion" maintained by juliangruber, specifically version 5.0.7 and all earlier releases. Any Node.js application that imports this module directly, or imports it indirectly via other modules such as minimatch or glob that use brace expansion, is susceptible. The issue exists in all environments where the vulnerable package is installed, regardless of deployment scale.

The CVSS score of 7.5 indicates a high severity and the EPSS score of less than 1% suggests that real‑world exploitation is currently unlikely, likely because the attack requires crafted input to reach the vulnerable routine. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker‑controlled input string supplied to the expand() function in an application – for example, through an HTTP request parameter, command‑line argument, or configuration file. The payload triggers gradual memory growth until the process crashes; no privilege escalation is required or achieved.