René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"vulnerabilities/NVD/CVE-2026-25547","articleBody":"brace-expansion@1.1.13 has the CVE-2026-25547 issue.\nWill the development team will upgrade the multimatch version?\nThanks\n\n[@isaacs](https://github.com/isaacs)/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, [@isaacs](https://github.com/isaacs)/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.\n\n+-- javascript-obfuscator@5.4.1\n| `-- multimatch@5.0.0\n|   `-- minimatch@3.1.5\n|     `-- brace-expansion@1.1.13\n","author":{"url":"https://github.com/GuoqiangChen918","@type":"Person","name":"GuoqiangChen918"},"datePublished":"2026-04-09T07:25:15.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/1405/javascript-obfuscator/issues/1405"}