Search: CVE-2026-25547

CVE-2026-25547 is a critical denial of service vulnerability in versions of the @isaacs/brace-expansion library prior to 5.0.1. The issue arises from inefficient handling of numeric brace ranges, where repeated ranges cause exponential growth in expansion attempts, leading to excessive CPU and memory consumption. This can crash Node.js processes using the vulnerable library without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 9.2, indicating critical severity. It affects applications and services that incorporate this library for pattern expansion, particularly in JavaScript/TypeScript environments.