# CVE-2025-5889: juliangruber brace-expansion index.js expand redos CVE-2025-5889 is fixed in 41 products on 1 platform, first by DEBIAN-CVE-2025-5889, released June 9, 2025. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2025-5889 - Priority: Routine - CVSS: 3.1 (moderate) - EPSS: 0.0061 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jun 9, 2025 - Weakness: Inefficient Regular Expression Complexity - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5889 ## Description A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | aws-cli opensuse-leap 15.6 | 1.33.26-150400.34.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | aws-cli sles 15.6 | 1.33.26-150400.34.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | aws-cli sles 15.7 | 1.33.26-150400.34.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | node-brace-expansion Debian 13.5 (trixie) | 2.0.1+~1.1.0-2 | [DEBIAN-CVE-2025-5889](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5889.md) | Jun 9, 2025 | | Linux | node-brace-expansion Debian 14 | 2.0.1+~1.1.0-2 | [DEBIAN-CVE-2025-5889](https://patchblox.com/security/data/fix/linux/debian-cve-2025-5889.md) | Jun 9, 2025 | | Linux | nodejs amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-debuginfo amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-debugsource amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-devel amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-docs amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-full-i18n amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-libs amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-libs-debuginfo amzn 2023 | 1:18.20.8-1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs-npm amzn 2023 | 1:10.8.2-1.18.20.8.1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | nodejs20 amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-debuginfo amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-debugsource amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-devel amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-docs amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-full-i18n amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-libs amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-libs-debuginfo amzn 2023 | 1:20.20.1-1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs20-npm amzn 2023 | 1:10.8.2-1.20.20.1.1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | nodejs22 amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-debuginfo amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-debugsource amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-devel amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-docs amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-full-i18n amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-libs amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-libs-debuginfo amzn 2023 | 1:22.22.0-1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | nodejs22-npm amzn 2023 | 1:10.9.4-1.22.22.0.1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | | Linux | python-boto3 opensuse-leap 15.6 | 1.34.138-150400.27.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-boto3 sles 15.6 | 1.34.138-150400.27.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-boto3 sles 15.7 | 1.34.138-150400.27.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-botocore opensuse-leap 15.6 | 1.34.144-150400.41.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-botocore sles 15.6 | 1.34.144-150400.41.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-botocore sles 15.7 | 1.34.144-150400.41.7.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-coverage opensuse-leap 15.6 | 7.6.10-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-coverage sles 15.6 | 7.6.10-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-coverage sles 15.7 | 7.6.10-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-flaky opensuse-leap 15.6 | 3.8.1-150400.14.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pluggy opensuse-leap 15.6 | 1.5.0-150400.14.10.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pluggy sles 15.6 | 1.5.0-150400.14.10.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pluggy sles 15.7 | 1.5.0-150400.14.10.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest opensuse-leap 15.6 | 8.3.5-150400.3.9.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest sles 15.6 | 8.3.5-150400.3.9.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest sles 15.7 | 8.3.5-150400.3.9.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-cov opensuse-leap 15.6 | 6.2.1-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-cov sles 15.6 | 6.2.1-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-cov sles 15.7 | 6.2.1-150400.12.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-mock opensuse-leap 15.6 | 3.14.0-150400.13.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-mock sles 15.6 | 3.14.0-150400.13.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | python-pytest-mock sles 15.7 | 3.14.0-150400.13.6.1 | [SUSE-SU-2025:3744-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-3744-1.md) | Oct 23, 2025 | | Linux | tree-sitter-ruby opensuse-leap 16.0 | 0.23.1-160000.3.1 | [OPENSUSE-SU-2026:20998-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20998-1.md) | Jun 22, 2026 | | Linux | v8-10.2-devel amzn 2023 | 3:10.2.154.26-1.18.20.8.1.amzn2023.0.2 | [ALAS2023-2025-1123](https://patchblox.com/security/data/fix/linux/alas2023-2025-1123.md) | Jul 29, 2025 | | Linux | v8-11.3-devel amzn 2023 | 3:11.3.244.8-1.20.20.1.1.amzn2023.0.2 | [ALAS2023-2026-1484](https://patchblox.com/security/data/fix/linux/alas2023-2026-1484.md) | Mar 16, 2026 | | Linux | v8-12.4-devel amzn 2023 | 3:12.4.254.21-1.22.22.0.1.amzn2023.0.2 | [ALAS2023-2026-1465](https://patchblox.com/security/data/fix/linux/alas2023-2026-1465.md) | Mar 2, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.