The vulnerability arises because the expand() function in juliangruber brace-expansion caps the number of expansions but not the length of each expansion. By chaining many brace groups (e.g., '{a,b}'.repeat(N)), the number of results is capped at 100,000 by default, but each result grows linearly with N in length. This causes memory usage to scale with max × N, leading to excessive memory consumption and a fatal out-of-memory crash in the Node.js process. The crash is uncatchable because it is a V8 fatal error, not a thrown exception. The fix introduces a maxLength limit (default 4,000,000 characters) on the total output length, truncating expansions to prevent unbounded memory use. This fix is available in patched releases beyond version 5.0.7.

Applications using vulnerable versions of brace-expansion (<=5.0.7) that process attacker-controlled input can be crashed by a crafted input string that triggers excessive memory allocation. The crash is a fatal V8 out-of-memory error that cannot be caught or handled, resulting in denial of service by terminating the Node.js process or worker. This impacts availability but does not directly compromise confidentiality or integrity.

Upgrade to a patched release of juliangruber brace-expansion beyond version 5.0.7 that includes the maxLength output length bounding fix. This fix prevents unbounded memory growth and fatal crashes. If upgrading immediately is not possible, avoid passing untrusted or attacker-controlled input to expand() or glob brace patterns, or explicitly configure both max and maxLength options to small values to limit resource consumption. The vendor advisory confirms the fix is available and effective.