3.1

CVE-2025-5889: juliangruber brace-expansion index.js expand redos

Deferred
AliasesUBUNTU-CVE-2025-5889DEBIAN-CVE-2025-5889CGA-24pq-p5jm-cw3j
Published 09-06-2025Last modified 11-06-2025

Vulnerability summary

CVE-2025-5889 is a low (CVSS 3.1) Uncontrolled Resource Consumption vulnerability in juliangruber brace-expansion. EPSS estimates a 0.59% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 2.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
3.1/10
010
Low · v3.1 (CVE.org)
EPSS score
0.59%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 5 · Related 23
OPENSUSE-SU-2025:15280-1OPENSUSE-SU-2025:15582-1OPENSUSE-SU-2026:11126-1OPENSUSE-SU-2026:20998-1SUSE-SU-2025:3744-1CGA-48F6-2XRX-CXVW

Timeline

  1. 09-06-2025
    PublishedVulnerability first disclosed.
  2. 11-06-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.

CVSS metrics

15 scores · 8 sources · 4 versions

EPSS trend

Probability

0.59%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.57% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    37A40Ce7D6E5Ca604858Fe30814D9466

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard158 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14-r3
  • arangodb-3.11-compat< 3.11.14-r3
  • arangodb-3.12< 3.12.5-r1
Wolfi41 products
  • argo-workflows< 3.6.10-r1
  • code-server< 4.100.3-r1
  • code-server-compat< 4.100.3-r1
  • eslint< 9.29.0-r0
  • jupyter-base-notebook< 7.6.1-r0 | < 7.6.3-r2
Alpine1 product
  • npm< 11.4.2-r0

3 vendors · 200 products · Showing 200 of 230

References

19 links
Show all 19 references