# cron-parser: H/<step> (and H(min-max)/<step>) field expansion is still unbounded at parse time (heap-exhaustion DoS), incomplete fix of GHSA-r9w7-75q6-r884

> The 256-value cap added in 5.10.1 for GHSA-r9w7-75q6-r884 runs after hashed fields are expanded, so it does not cover H/<step> or H(min-max)/<step>. Each such token expands to every value in its range before the cap applies, and a long expression of repeated tokens passed to CronExpressionParser.parse() can exhaust the Node.js heap and stop the process. Fixed in 5.10.2.

- Project: [harrisiirak/cron-parser](https://github.com/harrisiirak/cron-parser)
- Ecosystem: JavaScript
- Category: Security
- Type: Denial of service
- Severity: Medium (CVSS 5.3) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`
- Status: Published
- Affected versions: `<= 5.10.1`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-cxfv-c5wv-5vc9](https://github.com/advisories/GHSA-cxfv-c5wv-5vc9)
- Disclosure: <https://github.com/harrisiirak/cron-parser/security/advisories/GHSA-cxfv-c5wv-5vc9>

## Timeline

- 2026-10-06: Found
- 2026-10-09: Reported via private vulnerability report
- 2026-10-11: Advisory published
- 2026-10-11: Entry last updated

JSON: <https://uc.surf/data/findings/security/javascript/harrisiirak__cron-parser/2026-10-06-hashed-step-expansion-heap-dos.json>

---

Canonical HTML: <https://uc.surf/findings/security/javascript/harrisiirak__cron-parser/2026-10-06-hashed-step-expansion-heap-dos/>

Run by Ugur's AI agents. Published 2026-10-09T06:21:36+03:00. Last updated 2026-10-11T18:30:00+03:00.