Skip to content
Fencer Intel
low 3.1

CVE-2025-5889 json

juliangruber brace-expansion index.js expand redos

published last yr. modified last mo. also GHSA-v6h2-p8h4-qcjw , EUVD-2025-17567

cvss
3.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Patch / fix

  • npm brace-expansion 1.1.12, 2.0.2, 3.0.1, 4.0.1
  • juliangruber brace-expansion 1.1.12, 2.0.2, 3.0.1, 4.0.1
  • node-brace-expansion Debian 14, Debian 13 2.0.1+~1.1.0-2

debian advisories DEBIAN-CVE-2025-5889

  • aws-cli SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.33.26-150400.34.7.1
  • python-boto3 SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.138-150400.27.7.1
  • python-flaky openSUSE Leap 15.6 3.8.1-150400.14.6.1
  • python-pluggy SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 1.5.0-150400.14.10.1
  • python-pytest SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 8.3.5-150400.3.9.1
  • python-botocore SLE Module for Python 3 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +2 more 1.34.144-150400.41.7.1
  • python-coverage SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +9 more 7.6.10-150400.12.6.1
  • python-pytest-cov SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +8 more 6.2.1-150400.12.6.1

suse advisories SUSE-SU-2025:3744-1

  • velociraptor openSUSE Tumbleweed 0.7.0.4.git185.a5708584-2.1
  • tree-sitter-ruby openSUSE Leap 16.0 0.23.1-160000.3.1
  • tree-sitter-ruby openSUSE Tumbleweed 0.23.1-2.1
  • python-bqplot openSUSE Tumbleweed 0.12.45-10.1
  • python-furo openSUSE Tumbleweed 2024.8.6-3.1
  • python-ipympl openSUSE Tumbleweed 0.9.4-15.1
  • python-jupyter-ydoc openSUSE Tumbleweed 3.1.0-1.1
  • python-jupyterlab-templates openSUSE Tumbleweed 0.5.2-2.1

opensuse advisories openSUSE-SU-2026:11126-1openSUSE-SU-2026:20998-1openSUSE-SU-2025:15582-1openSUSE-SU-2025:15269-1openSUSE-SU-2025:15270-1openSUSE-SU-2025:15271-1

  • npm Alpine 3.22 11.4.2-r0

alpine advisories ALPINE-CVE-2025-5889

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nodejs18 CBL-Mariner 2.0 18.20.3-9

azure linux advisories AZL-63881

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2025-5889 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-5889 updated cvss 3.1

brace-expansion: juliangruber brace-expansion index.js expand redos

  • Red Hat Cryostat 4 io.cryostat-cryostat Red Hat AMQ Broker 7 jolokia-parent 2.4.2.redhat-00001 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-eda-controller, ansible-automation-platform-24/lightspeed-rhel8, ansible-automation-platform-25/lightspeed-rhel8, ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat build of Apache Camel - HawtIO 4 io.hawt-project Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat build of OptaPlanner 8 org.optaweb.vehiclerouting-optaweb-vehicle-routing
    affected: workaround, no fix available “Currently, no mitigation is available for this vulnerability.”
  • Red Hat Ceph Storage 4 brace-expansion Red Hat Ceph Storage 5 brace-expansion
    affected: workaround, no fix planned “Currently, no mitigation is available for this vulnerability.”
  • Red Hat Ceph Storage 6 brace-expansion Red Hat Ceph Storage 7 brace-expansion Red Hat Ceph Storage 8 brace-expansion Red Hat Data Grid 8 org.infinispan-infinispan-console Red Hat Directory Server 11 389-ds-base Red Hat Enterprise Linux 7 firefox, thunderbird
    +12 more products
    Red Hat Enterprise Linux 8 npm, pcs, nodejs, grafana, mozjs60, pcs-snmp, +18 more Red Hat Enterprise Linux 9 gjs, npm, pcs, nodejs, polkit, grafana, +10 more Red Hat Enterprise Linux 10 nodejs22, 389-ds-base, nodejs-nodemon Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-ui, io.syndesis-syndesis-parent Red Hat Integration Camel K 1 io.apicurio-apicurio-registry Red Hat JBoss Enterprise Application Platform 7 io.hawt-project, org.jboss.hal-hal-parent Red Hat JBoss Enterprise Application Platform 8 io.hawt-project, org.jboss.hal-hal-parent, org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack io.hawt-project, org.jboss.hal-hal-parent, org.keycloak-keycloak-parent Red Hat Process Automation 7 org.uberfire-uberfire-parent, org.kie.workbench-kie-wb-common, org.kie-process-migration-service Red Hat Quay 3 quay/quay-rhel8 Red Hat Single Sign-On 7 org.keycloak-keycloak-parent Red Hat streams for Apache Kafka 2 com.github.streamshub-console
    affected: workaround, no fix available “Currently, no mitigation is available for this vulnerability.”
  • Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1781863705
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2026:33154
  • Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764178221, odf4 v4.14-1764178222, odf4 v4.14-1764178236, odf4 v4.14-1764178261, odf4 v4.14-1764178273, odf4 v4.14-1764178319, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:22420
  • Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764176261, odf4 v4.15-1764176342, odf4 v4.15-1764176372, odf4 v4.15-1764176485, odf4 v4.15-1764176675, odf4 v4.15-1764176690, +11 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:22418
  • Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764168955, odf4 v4.16-1764169118, odf4 v4.16-1764169242, odf4 v4.16-1764169347, odf4 v4.16-1764169457, odf4 v4.16-1764169464, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:22416
  • Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764167795, odf4 v4.17-1764167826, odf4 v4.17-1764167834, odf4 v4.17-1764167876, odf4 v4.17-1764167987, odf4 v4.17-1764168179, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:22415
show 4 more
  • Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1761854280, odf4 v4.18-1761854289, odf4 v4.18-1761854319, odf4 v4.18-1761854321, odf4 v4.18-1761854398, odf4 v4.18-1761854422, +12 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:21368
  • Red Hat Openshift Data Foundation 4.19 odf4 v4.19-1761832915, odf4 v4.19-1761832946, odf4 v4.19-1761832992, odf4 v4.19-1761833034, odf4 v4.19-1761833068, odf4 v4.19-1761833085, +13 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:21378
  • Red Hat Openshift Data Foundation 4.20 odf4 v4.20-1761728558, odf4 v4.20-1761728716, odf4 v4.20-1761728784, odf4 v4.20-1761728797, odf4 v4.20-1761728814, odf4 v4.20-1761728854, +16 more
    fixed: vendor fix “Currently, no mitigation is available for this vulnerability.” RHSA-2025:21704
  • Red Hat Ceph Storage 7.1 rhceph/grafana-rhel9 1781855851, rhceph/keepalived-rhel9 1781855108, rhceph/snmp-notifier-rhel9 1781854814, rhceph/rhceph-haproxy-rhel9 1781856344, rhceph/rhceph-promtail-rhel9 1781856148 Red Hat Openshift Data Foundation 4.14 odf4 v4.14-1764225636, odf4 v4.14-1764225638, odf4 v4.14-1764225641, odf4 v4.14-1764225644, odf4 v4.14-1764225646, odf4 v4.14-1764225650, +2 more Red Hat Openshift Data Foundation 4.15 odf4 v4.15-1764223440, odf4 v4.15-1764223444, odf4 v4.15-1764223449, odf4 v4.15-1764223450, odf4 v4.15-1764223456, odf4 v4.15-1764223457, +1 more Red Hat Openshift Data Foundation 4.16 odf4 v4.16-1764224668, odf4 v4.16-1764224669, odf4 v4.16-1764224673, odf4 v4.16-1764224676, odf4 v4.16-1764224682, odf4 v4.16-1764224688, +4 more Red Hat Openshift Data Foundation 4.17 odf4 v4.17-1764174656, odf4 v4.17-1764174663, odf4 v4.17-1764174675, odf4 v4.17-1764174678, odf4 v4.17-1764174688, odf4 v4.17-1764174689, +6 more Red Hat Openshift Data Foundation 4.18 odf4 v4.18-1762335989, odf4 v4.18-1762335993, odf4 v4.18-1762335997, odf4 v4.18-1762335999, odf4 v4.18-1762336001, odf4 v4.18-1762336004, +6 more
    not affected: vulnerable code not present

2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • gist.github.com https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 2.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 3.0 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA 4.0 1.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA 2.0 2.1 AV:N/AC:H/Au:S/C:N/I:N/A:P
GitHub 3.1 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
npm brace-expansion
>=2.0.0, <2.0.2
>=1.0.0, <1.1.12
>=3.0.0, <3.0.1
>=4.0.0, <4.0.1
2.0.2
1.1.12
3.0.1
4.0.1

Affected products

  • juliangruber brace-expansion

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.