Skip to content

[core] Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation - #65

Merged
juliangruber merged 3 commits into
juliangruber:mainfrom
mmmsssttt404:main
Jun 11, 2025
Merged

[core] Potential ReDoS Vulnerability or Inefficient Regular Expression in Project: Need for Assessment and Mitigation#65
juliangruber merged 3 commits into
juliangruber:mainfrom
mmmsssttt404:main

Conversation

@mmmsssttt404

@mmmsssttt404 mmmsssttt404 commented Feb 9, 2025

Copy link
Copy Markdown
Contributor

Steps to reproduce
Hello,

I am writing to report a potential Regular Expression Denial of Service (ReDoS) vulnerability or Inefficient Regular Expression in the project. When using specially crafted input strings in the context, it may lead to extremely high CPU usage, application freezing, or denial of service attacks.

Location of Issue:

The vulnerability is related to a regular expression used in the following validation file, which may result in significantly prolonged execution times under certain conditions.

brace-expansion/index.js

Line 157 in 6a39bdd

if (m.post.match(/,.*\}/)) {

PoC Files and Comparisons:
gist:https://gist.github.com/mmmsssttt404/37a40ce7d6e5ca604858fe30814d9466
use time:
{50256729-A698-49A6-956C-8C3A4AD1C09C}
Proposed Solution:
Change the regular expression to

,(?!,).*\}

change:
https://github.com/mmmsssttt404/brace-expansion/blob/a5b98a4f30d7813266b221435e1eaaf25a1b0ac5/index.js#L157

{B146D730-72F0-41D8-8478-6488D50BEF79}

Thank you for your attention to this matter. Your evaluation and response to this potential security concern would be greatly appreciated.

Best regards,

Search keywords: ReDoS

@Soneliem

Soneliem commented Jun 11, 2025

Copy link
Copy Markdown

Can this PR be reviewed and merged considering this: GHSA-v6h2-p8h4-qcjw
@juliangruber

@OnLocation-jespinosa-contractor

OnLocation-jespinosa-contractor commented Jun 11, 2025 •
edited
Loading

Copy link
Copy Markdown

Hi @juliangruber, please accept the PR :D

@watson

watson commented Jun 11, 2025

Copy link
Copy Markdown

@isaacs I think you have admin write permissions to this repo as well?

juliangruber
juliangruber reviewed Jun 11, 2025
View reviewed changes
Comment thread test/redos.js Outdated
@juliangruber
juliangruber merged commit 0b6a978 into juliangruber:main Jun 11, 2025
@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

https://github.com/juliangruber/brace-expansion/releases/tag/v4.0.1

@silverwind

silverwind commented Jun 11, 2025

Copy link
Copy Markdown

Could this be backported to v2 and v3 releases?

@viceice

viceice commented Jun 11, 2025

Copy link
Copy Markdown

please also v1 because it's trasitively used by minimatch (especially by popular eslint package)

juliangruber added a commit that referenced this pull request Jun 11, 2025
@mmmsssttt404 @juliangruber
Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65
15f9b3c 
)

* Create redos.js

* Update index.js

* Update test/redos.js

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>
@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

https://github.com/juliangruber/brace-expansion/releases/tag/v3.0.1

@someonestolemyusername

This comment was marked as abuse.

Sign in to view
juliangruber added a commit that referenced this pull request Jun 11, 2025
@mmmsssttt404 @juliangruber
Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65
36603d5 
)

* Create redos.js

* Update index.js

* Update test/redos.js

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>
@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

https://github.com/juliangruber/brace-expansion/releases/tag/v2.0.2

juliangruber added a commit that referenced this pull request Jun 11, 2025
@mmmsssttt404 @juliangruber
Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65
c3c73c8 
)

* Create redos.js

* Update index.js

* Update test/redos.js

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>
@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.12

@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

@someonestolemyusername pull requests improving the test welcome

@qwilr-altonius

qwilr-altonius commented Jun 11, 2025

Copy link
Copy Markdown

Danke @juliangruber!

@ja-ka ja-ka mentioned this pull request Jun 11, 2025
Closed
1 task
@viceice

viceice commented Jun 11, 2025

Copy link
Copy Markdown

Now the advisory needs to be updated, tried it, but it seems i did a mistake 😕

@breadadams

breadadams commented Jun 11, 2025

Copy link
Copy Markdown

Thanks for backporting the fix @juliangruber! I noticed it's been released on GitHub, but not published to npm yet.

Is that something you're working on still?

@watson

watson commented Jun 11, 2025

Copy link
Copy Markdown

@breadadams it has been released to npm as well

@juliangruber

juliangruber commented Jun 11, 2025

Copy link
Copy Markdown
Owner

@breadadams https://www.npmjs.com/package/brace-expansion?activeTab=versions

bmwiedemann pushed a commit to bmwiedemann/openSUSE that referenced this pull request Jun 11, 2025
dgarcia @bmwiedemann
Update python-pytest-html to version 4.1.1 / rev 20 via SR 1284756
3792c7c 
https://build.opensuse.org/request/show/1284756
by user dgarcia + anag_factory
- refresh node modules
  * update brace-expansion to 1.1.12 and 2.0.2
  CVE-2025-5889, gh#juliangruber/brace-expansion#65, bsc#1244343
@turi4200 turi4200 mentioned this pull request Jun 11, 2025
Closed
@AzuKi9140 AzuKi9140 mentioned this pull request Jun 12, 2025
Merged
@tarngerine tarngerine mentioned this pull request Jun 12, 2025
Closed
2 tasks
@zachleat zachleat mentioned this pull request Jun 16, 2025
Closed
@doconnor-clintel doconnor-clintel mentioned this pull request Jun 17, 2025
Merged
@jonathandeclan jonathandeclan mentioned this pull request Jun 19, 2025
Closed
shaked-seal pushed a commit to ali-security/brace-expansion-6092 that referenced this pull request Apr 14, 2026
@mmmsssttt404 @juliangruber @shaked-seal
Fix potential ReDoS Vulnerability or Inefficient Regular Expression (j…
69ad20d 
…uliangruber#65)

* Create redos.js

* Update index.js

* Update test/redos.js

---------

Co-authored-by: Julian Gruber <julian@juliangruber.com>
XavierMP14

This comment was marked as off-topic.

Sign in to view

@claude claude Bot mentioned this pull request May 15, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@juliangruber juliangruber juliangruber left review comments
+4 more reviewers
@XavierMP14 XavierMP14 XavierMP14 left review comments
@telix5000 telix5000 telix5000 approved these changes
@nhattran998 nhattran998 nhattran998 approved these changes
@Dustin4444 Dustin4444 Dustin4444 approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.