[GHSA-mh99-v99m-4gvg] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

[G-Rath]

Updates

• Affected products
• References

Comments
Updated fixed versions due to backport

[github]

Hi there @juliangruber! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Pull request overview

Updates the advisory to reflect the brace-expansion 3.x security backport.

Changes:

• Adds 3.0.3 as a fixed version.
• Adds the backport pull request reference.
• Updates advisory metadata.

Comments suppressed due to low confidence (1)

advisories/github-reviewed/2026/07/GHSA-mh99-v99m-4gvg/GHSA-mh99-v99m-4gvg.json:53

• This new range does not mark 3.0.3 as safe: affected entries are unioned, and the existing introduced: "0" / fixed: "5.0.8" range still includes 3.0.3. Make the ranges non-overlapping—for example, start the existing 5.x/4.x range at 4.0.0, while retaining this 0 → 3.0.3 range—so 3.0.3 is actually excluded and the unfixed 4.x line remains affected.

              "introduced": "0"
            },
            {
              "fixed": "3.0.3"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.