Vulnerability in npm latest version - brace-expansion https://github.com/advisories/GHSA-f886-m6hf-6m8v

[Stamo-Gochev]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

# npm audit report


brace-expansion  4.0.0 - 5.0.4
Severity: moderate
brace-expansion: Zero-step sequence causes process hang and memory exhaustion - https://github.com/advisories/GHSA-f886-m6hf-6m8v
fix available via `npm audit fix`
node_modules/npm/node_modules/brace-expansion

Expected Behavior

No vulnerabilities are reported

Steps To Reproduce

1. Install "npm" and run npm audit - see Replace devDependencies with npm v11.13.0 dependency in package manifest Stamo-Gochev/semantic-release-vulnerabilities#3

Environment

• npm: latest
• Node.js: 24
• OS Name:
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

[Stamo-Gochev]

Similar to #9162

[owlstronaut]

These will be updated in the next deps release