CVE-2026-25547: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25547 is a denial-of-service (DoS) vulnerability in the @isaacs/brace-expansion npm package (a hybrid CJS/ESM TypeScript fork of brace-expansion) caused by unbounded brace range expansion. All versions up to and including 5.0.0 are affected; the issue was patched in version 5.0.1. The vulnerability was published on February 3, 2026, and assigned a CVSS v4.0 base score of 9.2 (Critical) by the package maintainer, though the GitHub Advisory Database rates it 8.7 (High) under a slightly different scoring configuration (Github Advisory, Security Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity) / CWE-400 (Uncontrolled Resource Consumption): the library expands brace expressions eagerly and synchronously without any upper bound or complexity limit on the number of combinations generated. When a pattern containing repeated numeric brace ranges is provided (e.g., {0..99}{0..99}{0..99}{0..99}{0..99}), the library generates up to 100^5 = 10,000,000,000 combinations before returning control to the caller, overwhelming the Node.js event loop and heap memory. No authentication or special privileges are required — a single crafted network request containing a small malicious payload is sufficient to trigger the condition. A public proof-of-concept script is included in the GitHub security advisory (Github Advisory, Security Advisory).

Successful exploitation causes complete availability loss of the targeted Node.js service: the process freezes, exhausts CPU and heap memory, blocks the event loop, and typically crashes with a FATAL ERROR: JavaScript heap out of memory. There is no confidentiality or integrity impact. Any application or downstream dependency that passes untrusted input to @isaacs/brace-expansion is vulnerable, including numerous IBM enterprise products (App Connect Enterprise, API Connect, Event Automation/Processing, watsonx Orchestrate, QRadar Suite Software, and Instana Observability) (Github Advisory, IBM Event Processing).

A public proof-of-concept exploit is available in the GitHub security advisory and can be reproduced with a minimal Node.js script. No authentication is required, and the attack can be launched remotely over the network with a very small payload. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042% (13th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Security Advisory).

1. Identify target: Locate a publicly accessible application or API endpoint that uses @isaacs/brace-expansion (version ≤ 5.0.0) to process user-supplied input — for example, a file search, glob-matching, or template expansion feature.
2. Craft malicious payload: Construct a brace expansion pattern designed to trigger exponential combination generation, such as {0..99}{0..99}{0..99}{0..99}{0..99}, which produces 10 billion combinations.
3. Deliver payload: Submit the crafted pattern as input to the vulnerable endpoint via a single HTTP request (e.g., as a query parameter, request body field, or API argument) — no authentication is needed.
4. Trigger resource exhaustion: The library synchronously attempts to expand all combinations, consuming all available CPU cycles and heap memory, blocking the Node.js event loop.
5. Achieve DoS: The Node.js process crashes with FATAL ERROR: JavaScript heap out of memory, taking down the service for all users until it is restarted (Github Advisory, Security Advisory).

• Logs: Node.js process logs showing FATAL ERROR: JavaScript heap out of memory or sudden process termination; application logs recording requests containing patterns with repeated numeric brace ranges (e.g., {0..99}{0..99}...).
• Process: Node.js process exhibiting 100% CPU utilization followed by an out-of-memory crash; unexpected service restarts or container/pod restarts in orchestrated environments.
• Network: Single HTTP requests with unusually small payloads (a few dozen bytes) that correlate with service crashes; repeated requests to the same endpoint from the same source IP triggering repeated crashes.

The primary remediation is to upgrade @isaacs/brace-expansion to version 5.0.1 or later, which introduces bounds checking on brace expansion complexity (Security Advisory). IBM has released security updates for all affected products: IBM Event Processing, IBM App Connect Enterprise (Certified Container), IBM API Connect, IBM watsonx Orchestrate, IBM QRadar Suite Software, and IBM Instana Observability — administrators should apply the relevant IBM security bulletins (IBM Event Processing, IBM API Connect). As interim workarounds, implement strict input validation and length/complexity limits on any user-supplied data processed by brace-expansion, and consider rate limiting or WAF rules to restrict requests containing repeated brace range patterns.

Heise Online reported on the vulnerability in the context of IBM App Connect Enterprise being crashable by attackers, noting the broad impact across IBM's product portfolio (Heise). The vulnerability was also noted in the Node.js community retrospective for the week of February 8, 2026, reflecting awareness among Node.js ecosystem maintainers. Multiple Linux distributions (openSUSE, Red Hat, Rocky Linux, AlmaLinux, Amazon Linux) issued security advisories and package updates, indicating broad downstream impact across the ecosystem.