A flaw in the brace-expansion npm package's expand() function causes exponential-time complexity when processing consecutive non-expanding brace groups. An attacker supplying crafted input to expand(), either directly or via dependencies like minimatch or glob, can cause significant CPU resource consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue as it limits output size but not recursion work. This vulnerability affects multiple Red Hat products that include brace-expansion as a transitive dependency. Red Hat has issued an advisory and recommends upgrading to a fixed version once released.

The vulnerability leads to denial of service by causing excessive CPU consumption and blocking the event loop in affected applications. This can degrade or halt service availability on systems using vulnerable versions of brace-expansion. There is no impact on confidentiality or integrity. The issue is exploitable remotely without authentication by supplying crafted input to the vulnerable function.

Red Hat advises upgrading to a fixed version of the brace-expansion package when it becomes available. Currently, there is no practical mitigation for this vulnerability. Because brace-expansion is typically a transitive dependency pulled in via minimatch and glob, isolating it is difficult. Users should monitor Red Hat advisories for updates and apply patches promptly once released.