CVE-2025-5889
LowAdvisory
Published 9 Jun 2025In the index since 5 Sept 2026
- Severity
- Low
- worst across findings
- CVSS
- 3.1
- base score, highest
- EPSS
- 0.006
- 45th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 727
- of 17,787 indexed, latest versions
- Container images
- 765
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
brace-expansion Regular Expression Denial of Service vulnerability
Carried by container images the latest versions of 727 of 17,787 indexed charts deploy, on 765 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| brace-expansionnpm | 1.1.1, 1.1.2, 1.1.4, 1.1.6+5 more | 1.1.12, 2.0.2 | 765 |
| node-brace-expansiondeb | 1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1 | no fix listed | 5 |
- OSV records
- GHSA-v6h2-p8h4-qcjwUBUNTU-CVE-2025-5889
Charts affected
727 by stars
Container images carrying it
765 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| zl0i/ | e94047931739 | brace-expansion | 1.1.12 | 1 |
| zooz/ | f491d1f7a865 | brace-expansion | 1.1.12 | 1 |
| zwavejs/ | 15a6040fb468 | brace-expansion | 1.1.12 | 1 |
| gcr.io/ | 49d458a3650f | brace-expansion | 1.1.12 | 1 |
| gcr.io/ | 6eb201217a8f | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 2a115e991894 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | ea7e7f0e293e | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 140aed2752c3 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | a52dc5db694a | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 737ec361ed24 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 985456bdfb46 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | e103abadfb52 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 34b76dcb1c10 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 13e267ad7d94 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 7d1951b6baf5 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | d041bbf2814f | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | dffc6c719d86 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | fcbab3a24880 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 5889bea38e56 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | c8a0d5ec5a12 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 967470f05472 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 637083d9369d | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | cbc6e3ea157d | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 6fde1edc0983 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 38b6a50a62b2 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | c01e018bced4 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | a53ef16b024a | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 3947bfd04f49 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | ca7dc7362968 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | a058034ca006 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 29ecf8d4fa65 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 16fda01ae58a | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | a1fed512261f | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 0cf25ed621e2 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 0635f17c9d2c | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | e34964e336c1 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 0c5a3398d1e4 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 8ba040e79ca0 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | aaab005242ae | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 8344061b2f22 | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | e9716966f30b | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 7fe76551a78e | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | 8c68abbe1cff | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | cc9498b64b5b | brace-expansion | 2.0.2 | 1 |
| ghcr.io/ | a8d40779eeae | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | c739b74dabb0 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 8b621866ceb2 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 5a9216989707 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 38a4f32fad82 | brace-expansion | 1.1.12 | 1 |
| ghcr.io/ | 4ddbb244c82f | brace-expansion | 1.1.12 | 1 |