brace-expansion: Zero-step sequence causes process hang and memory exhaustion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33750 · Microsoft / collected KEV context

EUVD-2026-16620

GHSA-f886-m6hf-6m8v

cve-program · CVE-2026-33750

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
• https://github.com/juliangruber/brace-expansion/issues/98
• https://github.com/juliangruber/brace-expansion/pull/95
• https://github.com/juliangruber/brace-expansion/pull/96
• https://github.com/juliangruber/brace-expansion/pull/97
• https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
• https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
• https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

euvd · EUVD-2026-16620

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
• https://github.com/juliangruber/brace-expansion/issues/98
• https://github.com/juliangruber/brace-expansion/pull/95
• https://github.com/juliangruber/brace-expansion/pull/96
• https://github.com/juliangruber/brace-expansion/pull/97
• https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
• https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
• https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

nvd · CVE-2026-33750

• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184
• https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
• https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
• https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
• https://github.com/juliangruber/brace-expansion/issues/98
• https://github.com/juliangruber/brace-expansion/pull/95
• https://github.com/juliangruber/brace-expansion/pull/96
• https://github.com/juliangruber/brace-expansion/pull/97
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v

osv · GHSA-f886-m6hf-6m8v

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v
• https://nvd.nist.gov/vuln/detail/CVE-2026-33750
• https://github.com/juliangruber/brace-expansion/issues/98
• https://github.com/juliangruber/brace-expansion/pull/95
• https://github.com/juliangruber/brace-expansion/pull/96
• https://github.com/juliangruber/brace-expansion/pull/97
• https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5
• https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2
• https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a
• https://github.com/juliangruber/brace-expansion
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113
• https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184

No related operational record is retained in the current change model.