- ApplicationAdmin Console
- Hop 1declared · ~4.4.9tailwindcss4.4.9
- Hop 2transitive · ^6.1.0cors6.1.0
- Faulttransitive · ^2.0.0
USY-2026-0113 · Regular expression denial of service · score 5.3
Nested comma groups are expanded eagerly. A short pattern can produce a very large intermediate array before any consumer applies a limit.
SyntheticThis advisory is invented for the demonstration. brace-expansion is a real package; nothing described here has been reported against it.
Drop the application at one end and the flawed release at the other, and count what is left in the middle. cors sits on 4 of the 9 shortest paths, which makes it the cheapest single place to break the chain.
Admin Console · Auth Gateway · Inventory Sync · Notification Relay
Ledger API · Mobile BFF
Docs Site
Docs Site
Docs Site
One account can publish this package. Whoever holds it can reach everything downstream of it, with or without an advisory.
Affected. Fixed in 2.0.2.
Checkout Service
Ledger API
Mobile BFF
Storefront Web
Checkout Service
Notification Relay
Auth Gateway