CVE-2026-33750: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33750 is a Denial of Service vulnerability in the brace-expansion npm package caused by uncontrolled resource consumption (CWE-400) when processing brace patterns with a zero step value (e.g., {1..2..0}). Disclosed on March 24, 2026 via GitHub Advisory GHSA-f886-m6hf-6m8v, it affects brace-expansion versions prior to 1.1.13, 2.0.3, 3.0.2, and 5.0.5 for Node.js. Downstream products from IBM and Microsoft are also affected. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Microsoft MSRC).

The root cause lies in the sequence generation loop within brace-expansion/src/index.ts (around line 184), where the increment value is computed as Math.abs(numeric(n[2])). When a step of 0 is provided, Math.abs(0) = 0, causing the loop variable i to never advance, resulting in an infinite loop (brace-expansion source). The max output limit is only checked at the combination step — not during sequence generation — so it provides no protection against this condition. On a test machine, the process hangs for approximately 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a RangeError. The attack requires no authentication and only a 10-byte input string, and affects any application that passes untrusted strings to expand(), including tools built on minimatch and glob (GitHub Advisory).

Successful exploitation causes a Denial of Service: the affected Node.js process hangs for several seconds and consumes up to 1.9 GB of memory before crashing with a RangeError. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. The broad use of brace-expansion as a transitive dependency in tools like minimatch, glob, and numerous CLI utilities means the attack surface extends to a wide range of applications, including enterprise products from IBM (watsonx, Maximo, QRadar EDR, App Connect Enterprise, Db2, Guardium, and others) and Microsoft Node.js distributions (GitHub Advisory, IBM Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is unauthenticated and network-reachable with low attack complexity, requiring no user interaction. The EPSS score is approximately 0.054%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate an application that accepts user-controlled input and passes it to the brace-expansion expand() function — this includes web services, CLI tools, or configuration parsers built on minimatch or glob.
2. Craft malicious payload: Construct a brace expansion pattern with a zero step value, such as {1..2..0} (only 10 bytes), which triggers the infinite loop condition.
3. Deliver payload: Submit the crafted string as input to the vulnerable application — via an HTTP request parameter, CLI argument, config file field, or any other input vector that reaches expand().
4. Trigger DoS: The sequence generation loop runs indefinitely (increment = Math.abs(0) = 0), causing the Node.js process to hang for several seconds and allocate up to 1.9 GB of memory before throwing a RangeError and crashing or becoming unresponsive (GitHub Advisory, brace-expansion source).

• Logs: Application logs showing RangeError exceptions or unhandled promise rejections originating from brace-expansion or minimatch/glob modules; Node.js process crash logs with stack traces referencing index.ts or index.js in brace-expansion.
• Process Behavior: Node.js process exhibiting sustained high CPU usage and rapid memory growth (approaching 1.9 GB) before terminating; process hang or timeout errors in application health checks.
• Network: Repeated requests containing brace expansion patterns with zero step values (e.g., strings matching \{\d+\.\.\d+\.\.0\}) in HTTP parameters, headers, or request bodies.

Upgrade brace-expansion to a patched version: 1.1.13 (for 1.x), 2.0.3 (for 2.x), 3.0.2 (for 3.x), or 5.0.5 (for 5.x). The fix changes the increment computation from Math.abs(numeric(n[2])) to Math.max(Math.abs(numeric(n[2])), 1), ensuring the loop always advances by at least 1 (commit 311ac0d, commit 7fd684f). As a workaround where upgrading is not immediately possible, restrict or validate user-controlled input before it reaches expand(), rejecting patterns with a zero step value. IBM and Microsoft have released or are releasing patches for their affected downstream products; consult the respective vendor advisories for product-specific guidance (IBM Advisory, Microsoft MSRC).

Atlassian included this CVE in its May 19, 2026 security bulletin covering Bamboo, Confluence, and Jira, patching 42 vulnerabilities (Atlassian Bulletin). IBM issued multiple advisories across its product portfolio, including watsonx, Maximo, QRadar EDR, App Connect Enterprise, and Guardium, reflecting the broad transitive dependency impact of this library vulnerability (IBM Advisory). Snyk CLI v1.1304 also incorporated detection for this vulnerability (Snyk CLI).