CVE catalog

CVE-2025-5889

node-brace-expansion: CVE-2025-5889

Severity: Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: Jun 9, 2025, 6:16:01 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.59% · Oct 25, 2026

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-brace-expansion	sid	`2.1.7+~1.1.2-1`	fixed
Debian	node-brace-expansion	forky	`2.1.7+~1.1.2-1`	fixed
Debian	node-brace-expansion	trixie	`2.0.1+~1.1.0-2`	fixed
Debian	node-brace-expansion	bookworm	`2.0.1-2`	vulnerable
Npm	brace-expansion	Not reported	`4.0.1`	fixed
Npm	brace-expansion	Not reported	`1.1.12`	fixed
Npm	brace-expansion	Not reported	`3.0.1`	fixed
Npm	brace-expansion	Not reported	`4.0.1`	fixed
Opensuse	tree-sitter-ruby	leap 16.0	`0.23.1-160000.3.1`	fixed
Opensuse	tree-sitter-ruby	tumbleweed	`0.23.1-2.1`	fixed
Opensuse	python-pydata-sphinx-theme	tumbleweed	`0.16.1-1.1`	fixed
Opensuse	python-pytest-html	tumbleweed	`4.1.1-6.1`	fixed
Opensuse	python-nbdime	tumbleweed	`4.0.2-20.1`	fixed
Opensuse	python-plotly	tumbleweed	`6.1.2-1.1`	fixed
Opensuse	python-panel	tumbleweed	`1.7.1-1.1`	fixed
Opensuse	python-nbclassic	tumbleweed	`1.3.1-1.1`	fixed
Opensuse	python-jupyterlab-templates	tumbleweed	`0.5.2-2.1`	fixed
Opensuse	python-ipympl	tumbleweed	`0.9.4-15.1`	fixed
Opensuse	python-jupyter-ydoc	tumbleweed	`3.1.0-1.1`	fixed
Opensuse	python-furo	tumbleweed	`2024.8.6-3.1`	fixed
Opensuse	python-bqplot	tumbleweed	`0.12.45-10.1`	fixed
Ubuntu	node-brace-expansion	18.04	`1.1.8-1`	vulnerable
Ubuntu	node-brace-expansion	20.04	`1.1.8-1`	vulnerable
Ubuntu	node-brace-expansion	20.04	`1.1.11-1`	vulnerable
Ubuntu	node-brace-expansion	22.04	`2.0.0-1`	vulnerable
Ubuntu	node-brace-expansion	22.04	`2.0.1-1`	vulnerable
Ubuntu	node-brace-expansion	24.04	`2.0.1-2`	vulnerable
Ubuntu	node-brace-expansion	24.04	`2.0.1+~1.1.0-1`	vulnerable
Ubuntu	node-brace-expansion	25.10	`2.0.1+~1.1.0-1`	vulnerable
Ubuntu	node-brace-expansion	25.10	`2.0.1+~1.1.0-2`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-brace-expansion	source	sid	`2.0.1+~1.1.0-2`	not yet assigned	Not reported	[1107695]
Debian	node-brace-expansion	source	forky	`2.0.1+~1.1.0-2`	not yet assigned	Not reported	[1107695]
Debian	node-brace-expansion	source	trixie	`2.0.1+~1.1.0-2`	not yet assigned	Not reported	[1107695]
Debian	node-brace-expansion	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1107695]
Npm	brace-expansion	npm	Not reported	`4.0.1`	Not reported	GHSA-V6H2-P8H4-QCJW	Not reported
Npm	brace-expansion	npm	Not reported	`1.1.12`	Not reported	Not reported	Not reported
Npm	brace-expansion	npm	Not reported	`3.0.1`	Not reported	Not reported	Not reported
Npm	brace-expansion	npm	Not reported	`4.0.1`	Not reported	Not reported	Not reported
Opensuse	tree-sitter-ruby	rpm	leap 16.0	`0.23.1-160000.3.1`	Not reported	OPENSUSE-SU-2026:20998-1	Not reported
Opensuse	tree-sitter-ruby	rpm	tumbleweed	`0.23.1-2.1`	Not reported	OPENSUSE-SU-2025:15582-1	Not reported
Opensuse	python-pydata-sphinx-theme	rpm	tumbleweed	`0.16.1-1.1`	Not reported	OPENSUSE-SU-2025:15279-1	Not reported
Opensuse	python-pytest-html	rpm	tumbleweed	`4.1.1-6.1`	Not reported	OPENSUSE-SU-2025:15280-1	Not reported
Opensuse	python-nbdime	rpm	tumbleweed	`4.0.2-20.1`	Not reported	OPENSUSE-SU-2025:15276-1	Not reported
Opensuse	python-plotly	rpm	tumbleweed	`6.1.2-1.1`	Not reported	OPENSUSE-SU-2025:15278-1	Not reported
Opensuse	python-panel	rpm	tumbleweed	`1.7.1-1.1`	Not reported	OPENSUSE-SU-2025:15277-1	Not reported
Opensuse	python-nbclassic	rpm	tumbleweed	`1.3.1-1.1`	Not reported	OPENSUSE-SU-2025:15275-1	Not reported
Opensuse	python-jupyterlab-templates	rpm	tumbleweed	`0.5.2-2.1`	Not reported	OPENSUSE-SU-2025:15274-1	Not reported
Opensuse	python-ipympl	rpm	tumbleweed	`0.9.4-15.1`	Not reported	OPENSUSE-SU-2025:15271-1	Not reported
Opensuse	python-jupyter-ydoc	rpm	tumbleweed	`3.1.0-1.1`	Not reported	OPENSUSE-SU-2025:15273-1	Not reported
Opensuse	python-furo	rpm	tumbleweed	`2024.8.6-3.1`	Not reported	OPENSUSE-SU-2025:15270-1	Not reported
Opensuse	python-bqplot	rpm	tumbleweed	`0.12.45-10.1`	Not reported	OPENSUSE-SU-2025:15269-1	Not reported

[Debian bug #1107695]

Notes

[bookworm] node-brace-expansion: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-brace-expansion]Affected
Details (2)
- 2.0.1-2 · all · bookworm
  Affected
  dsa · node-brace-expansion · debian · bookworm; dsa · node-brace-expansion · debian · 12
- 2.0.1-2 · all · bookworm
  Affected
  dsa · node-brace-expansion · debian · bookworm; dsa · node-brace-expansion · debian · 12

[openSUSE Tumbleweed]

[jupyter-bqplot-jupyterlab]Unknown
Source package: [python-bqplot]
Details (1)
- 0.5.46-15.1 · noarch · tumbleweed
  Unknown · Fixed: 0.12.45-10.1
  Version impact unknown
  dsa · python-bqplot · opensuse · tumbleweed
[jupyter-bqplot-notebook]Unknown
Source package: [python-bqplot]
Details (1)
- 0.5.46-15.1 · noarch · tumbleweed
  Unknown · Fixed: 0.12.45-10.1
  Version impact unknown
  dsa · python-bqplot · opensuse · tumbleweed
[jupyter-jupyterlab-templates]Unknown
Source package: [python-jupyterlab-templates]
Details (1)
- 0.5.3-2.3 · noarch · tumbleweed
  Unknown · Fixed: 0.5.2-2.1
  Version impact unknown
  dsa · python-jupyterlab-templates · opensuse · tumbleweed
[jupyter-matplotlib]Unknown
Source package: [python-ipympl]
Details (1)
- 0.11.7-18.1 · noarch · tumbleweed
  Unknown · Fixed: 0.9.4-15.1
  Version impact unknown
  dsa · python-ipympl · opensuse · tumbleweed
[jupyter-matplotlib-jupyterlab]Unknown
Source package: [python-ipympl]
Details (1)
- 0.11.7-18.1 · noarch · tumbleweed
  Unknown · Fixed: 0.9.4-15.1
  Version impact unknown
  dsa · python-ipympl · opensuse · tumbleweed
[jupyter-nbclassic]Unknown
Source package: [python-nbclassic]
Details (1)
- 1.3.3-2.3 · noarch · tumbleweed
  Unknown · Fixed: 1.3.1-1.1
  Version impact unknown
  dsa · python-nbclassic · opensuse · tumbleweed
[jupyter-nbdime]Unknown
Source package: [python-nbdime]
Details (1)
- 7.0.4-24.1 · noarch · tumbleweed
  Unknown · Fixed: 4.0.2-20.1
  Version impact unknown
  dsa · python-nbdime · opensuse · tumbleweed
[jupyter-nbdime-jupyterlab]Unknown
Source package: [python-nbdime]
Details (1)
- 3.0.4-24.1 · noarch · tumbleweed
  Unknown · Fixed: 4.0.2-20.1
  Version impact unknown
  dsa · python-nbdime · opensuse · tumbleweed
[jupyter-panel]Unknown
Source package: [python-panel]
Details (1)
- 1.8.10-2.3 · noarch · tumbleweed
  Unknown · Fixed: 1.7.1-1.1
  Version impact unknown
  dsa · python-panel · opensuse · tumbleweed
[jupyter-plotly]Unknown
Source package: [python-plotly]
Details (1)
- 6.7.0-2.2 · noarch · tumbleweed
  Unknown · Fixed: 6.1.2-1.1
  Version impact unknown
  dsa · python-plotly · opensuse · tumbleweed
[python313-bqplot]Unknown
Source package: [python-bqplot]
Details (1)
- 0.13.1-15.1 · noarch · tumbleweed
  Unknown · Fixed: 0.12.45-10.1
  Version impact unknown
  dsa · python-bqplot · opensuse · tumbleweed
[python313-furo]Unknown
Source package: [python-furo]
Details (1)
- 2025.12.19-1.4 · noarch · tumbleweed
  Unknown · Fixed: 2024.8.6-3.1
  Version impact unknown
  dsa · python-furo · opensuse · tumbleweed
[python313-ipympl]Unknown
Source package: [python-ipympl]
Details (1)
- 0.10.0-18.1 · noarch · tumbleweed
  Unknown · Fixed: 0.9.4-15.1
  Version impact unknown
  dsa · python-ipympl · opensuse · tumbleweed
[python313-jupyterlab-templates]Unknown
Source package: [python-jupyterlab-templates]
Details (1)
- 0.5.3-2.3 · noarch · tumbleweed
  Unknown · Fixed: 0.5.2-2.1
  Version impact unknown
  dsa · python-jupyterlab-templates · opensuse · tumbleweed
[python313-jupyter-ydoc]Unknown
Source package: [python-jupyter-ydoc]
Details (1)
- 3.5.0-1.3 · noarch · tumbleweed
  Unknown · Fixed: 3.1.0-1.1
  Version impact unknown
  dsa · python-jupyter-ydoc · opensuse · tumbleweed
[python313-nbclassic]Unknown
Source package: [python-nbclassic]
Details (1)
- 1.3.3-2.3 · noarch · tumbleweed
  Unknown · Fixed: 1.3.1-1.1
  Version impact unknown
  dsa · python-nbclassic · opensuse · tumbleweed
[python313-nbdime]Unknown
Source package: [python-nbdime]
Details (1)
- 4.0.4-24.1 · noarch · tumbleweed
  Unknown · Fixed: 4.0.2-20.1
  Version impact unknown
  dsa · python-nbdime · opensuse · tumbleweed
[python313-nbdime-git]Unknown
Source package: [python-nbdime]
Details (1)
- 4.0.4-24.1 · noarch · tumbleweed
  Unknown · Fixed: 4.0.2-20.1
  Version impact unknown
  dsa · python-nbdime · opensuse · tumbleweed
[python313-nbdime-hg]Unknown
Source package: [python-nbdime]
Details (1)
- 4.0.4-24.1 · noarch · tumbleweed
  Unknown · Fixed: 4.0.2-20.1
  Version impact unknown
  dsa · python-nbdime · opensuse · tumbleweed

Next results

Observed: Oct 24, 2026, 10:03:08 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]