brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

brace-expansion through 5.0.6 is vulnerable to denial of service. The ...

Security update for python-pytest-html

Important: nodejs-nodemon security update

Important: nodejs:24 security update

Important: nodejs:22 security update

ELSA-2026-47058: nodejs:22 security update (IMPORTANT)

ELSA-2026-47057: nodejs:24 security update (IMPORTANT)

Security update for agama-web-ui