index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

Affected: npm: brace-expansion

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

``` var expand = require('brace-expansion'); expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}'); ```

## Recommendation

Update to version 1.1.7 or later.

nodejs-brace-expansion: Regular expression denial of service nodejs-chownr: TOCTOU vulnerability in `chownr` function in chownr.js nodejs-sshpk: ReDoS when parsing crafted invalid public keys in lib/formats/ssh.js nodejs-deep-extend: Prototype pollution can allow attackers to modify object properties npm: Symlink reference outside of node_modules folder through the bin field upon installation npm: Arbitrary file write via constructed entry in the package.json bin field npm: Global node_modules Binary Overwrite

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Software Collections ausnutzen, um die Vertraulichkeit, Verfügbarkeit und die Integrität der Anwendungen zu gefährden.