The brace-expansion library generates strings from brace patterns. A zero‑step value (e.g., {1..2..0}) causes its sequence generator to loop indefinitely, making the calling process hang for seconds and allocating large amounts of memory. The result is a denial of service that would impact the application or container in which the library runs. The weakness is classified as uncontrolled resource consumption (CWE‑400) and unchecked input handling (CWE‑606). No evidence indicates code execution is possible.

The vulnerability affects all releases of the npm package brace-expansion by Julian Gruber that are older than version 5.0.5, 3.0.2, 2.0.3, and 1.1.13. Any project that imports this package directly or indirectly via another dependency is at risk unless the library has been upgraded to a fixed release.

The CVSS score for this issue is 6.5, reflecting moderate severity. EPSS indicates less than 1% probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could trigger the flaw by supplying a brace pattern with a zero step value to expand() from untrusted input, causing the process to hang and use excessive memory. The likely attack vector would require an application that calls expand() with user‑controlled data, potentially leading to a loss of availability for the affected system.