GHSA-7h2j-956f-4vf2 @isaacs/brace-expansion has Uncontrolled Resource Consumption - Critical

[huakaibird]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Our security scan tool just scanned this critical CVE out -- GHSA-7h2j-956f-4vf2
GHSA-7h2j-956f-4vf2

@isaacs/brace-expansion is vulnerable to a Denial of Service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process.

Expected Behavior

No response

Steps To Reproduce

No response

Environment

• npm: 11.8.0
• Node.js:
• OS Name:
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

[MikeMcC399]

I'm seeing this fixed now in npm@11.9.0 through PR #8960

└─┬ npm@11.9.0
  └─┬ minimatch@10.1.2
    └── @isaacs/brace-expansion@5.0.1