PT-2026-6323 · Isaacs+1 · @Isaacs/Brace-Expansion+1

Jvr2022 · Publicado 2026-02-03 · Atualizado 2026-06-11 · CVE-2026-25547

Positive Technologies (AI Summary) · Pt

CVSS v4.0

9.2

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Nome do Software Vulnerável e Versões Afetadas @isaacs/brace-expansion versões anteriores a 5.0.1

Descrição @isaacs/brace-expansion, um fork híbrido CJS/ESM em TypeScript do brace-expansion, está sujeito a um problema de negação de serviço (DoS). Isso ocorre devido à expansão ilimitada de intervalos de chaves ao processar padrões com intervalos numéricos repetidos entre chaves. A biblioteca tenta gerar todas as combinações possíveis de forma síncrona, levando ao consumo excessivo de CPU e memória, podendo causar a falha do processo do Node.js.

Recomendações Atualize o @isaacs/brace-expansion para a versão 5.0.1 ou posterior.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

ALSA-2026:7080

ALSA-2026:7123

ALSA-2026:7350

ALSA-2026:7675

BDU:2026-01718

CLEANSTART-2026-CE10526

CLEANSTART-2026-DV49099

CLEANSTART-2026-GS57401

CLEANSTART-2026-NB51079

CLEANSTART-2026-NY12442

CLEANSTART-2026-OW14933

CLEANSTART-2026-SW34937

CVE-2026-25547

ECHO-0199-0689-E425

GHSA-7H2J-956F-4VF2

OPENSUSE-SU-2026:10168-1

OPENSUSE-SU-2026:10236-1

OPENSUSE-SU-2026:10250-1

OPENSUSE-SU-2026:10251-1

OPENSUSE-SU-2026:10252-1

OPENSUSE-SU-2026:10253-1

OPENSUSE-SU-2026:10254-1

OPENSUSE-SU-2026:10268-1

OPENSUSE-SU-2026:10269-1

OPENSUSE-SU-2026:10424-1

OPENSUSE-SU-2026:10428-1

OPENSUSE-SU-2026:20239-1

OPENSUSE-SU-2026:20261-1

OPENSUSE-SU-2026:20502-1

OPENSUSE-SU-2026:20503-1

OPENSUSE-SU-2026:20504-1

RHSA-2026:7080

RHSA-2026:7123

RHSA-2026:7302

RHSA-2026:7310

RHSA-2026:7350

RHSA-2026:7675

RHSA-2026:7983

SUSE-SU-2026:1008-1

SUSE-SU-2026:1013-1

SUSE-SU-2026:1035-1

SUSE-SU-2026:1148-1

SUSE-SU-2026:1232-1

SUSE-SU-2026:1249-1

SUSE-SU-2026:1250-1

SUSE-SU-2026:1251-1

SUSE-SU-2026:1524-1

SUSE-SU-2026:20574-1

SUSE-SU-2026:21022-1

SUSE-SU-2026:21023-1

SUSE-SU-2026:21024-1

SUSE-SU-2026:21166-1

SUSE-SU-2026:21167-1

SUSE-SU-2026:21168-1

SUSE-SU-2026:21241-1

SUSE-SU-2026:21245-1

SUSE-SU-2026:21246-1

SUSE-SU-2026:21253-1

SUSE-SU-2026:21256-1

SUSE-SU-2026:21321-1

SUSE-SU-2026:21785-1

SUSE-SU-2026:2363-1

Produtos afetados

@Isaacs/Brace-Expansion

Rocky Linux

Referências · 352

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25547.json · Exploit
• https://github.com/isaacs/brace-expansion · Nota
• https://github.com/isaacs/brace-expansion/security/advisories/GHSA-7h2j-956f-4vf2 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NY12442.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CE10526.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OW14933.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NY12442 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GS57401.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NB51079.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DV49099.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SW34937.json · Nota
• https://access.redhat.com/security/cve/CVE-2026-1525 · Nota
• https://cve.org/CVERecord?id=CVE-2026-25547 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-62348 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2026:20261-1 · Aviso do Fabricante