brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), …

{
                    "vendor": "juliangruber",
                    "product": "brace-expansion",
                    "collectionURL": "https://registry.npmjs.org",
                    "packageName": "brace-expansion",
                    "repo": "https://github.com/juliangruber/brace-expansion",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0",
                            "lessThanOrEqual": "5.0.6",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }