@isaacs/brace-expansion, a TypeScript fork of the brace‑expansion library, contains a denial of service flaw that triggers when an attacker supplies a pattern with repeated numeric brace ranges. The library attempts to eagerly generate every combination synchronously, and because the possible combinations grow exponentially, even a modest input can exhaust CPU cycles and memory, eventually crashing the Node.js process. The issue is rooted in resource exhaustion (CWE‑1333) and potential uncontrolled recursion or expansion (CWE‑409).

Applications that depend on isaacs:brace-expansion before version 5.0.1 are affected. Any Node.js project importing this library, especially those that process user‑supplied brace patterns, should be considered vulnerable. The problem is limited to the library itself; other Node.js modules are not directly impacted unless they transitively use brace‑expansion.

The flaw carries a CVSS score of 9.2, indicating a high severity impact. Current exploit probability according to EPSS is below 1%, suggesting a low likelihood of widespread exploitation, though no high‑profile exploits have been reported. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote or local, depending on whether the application accepts user input that is handed to brace‑expansion. An attacker could send a crafted pattern over the network or supply it via a command line argument, leading to denial of service against the affected process.