Juliangruber vulnerabilities
We track 7 vulnerabilities in Juliangruber products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
Latest Juliangruber vulnerabilities
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion site
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the r
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing at
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace group
- 7.7 High severity
brace-expansion: Uncontrolled Resource Consumption
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transiti
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop g
- 7.5 High severity
brace-expansion: Uncontrolled Resource Consumption
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely