CVE-2026-14257 with a CVSS score of 7.5 is a vulnerability affecting brace-expansion versions <= 5.0.7 in the brace-expansion module that allows an attacker to cause a denial-of-service (DoS) via unbounded expansion length, leading to an out-of-memory process crash. This flaw occurs when an application passes attacker-influenced strings to expand, directly or transitively via minimatch/glob brace patterns, allowing a small request to crash the worker/process. The issue is caused by the failure of the module to bound the total number of characters that a single expand call may accumulate, leading to memory exhaustion and fatal V8 out-of-memory errors. A patched release bounds the total number of characters a single expand call may accumulate (EXPANSION_MAX_LENGTH), applied inside the output-building loops so intermediate arrays are bounded too. The fix sits well above any realistic expansion, so legitimate input is unaffected.
We recommend you to update brace-expansion to version 5.0.8.[/subscribe_to_unlock_form]
CVE-2026-14257 with a CVSS score of 7.5 is a vulnerability affecting brace-expansion versions <= 5.0.7 in the brace-expansion module that allows an attacker to cause a denial-of-service (DoS) via unbounded expansion length, leading to an out-of-memory process crash. This flaw occurs when an application passes attacker-influenced strings to expand, directly or transitively via minimatch/glob brace patterns, allowing a small request to crash the worker/process. The issue is caused by the failure of the module to bound the total number of characters that a single expand call may accumulate, leading to memory exhaustion and fatal V8 out-of-memory errors. A patched release bounds the total number of characters a single expand call may accumulate (EXPANSION_MAX_LENGTH), applied inside the output-building loops so intermediate arrays are bounded too. The fix sits well above any realistic expansion, so legitimate input is unaffected.
We recommend you to update brace-expansion to version 5.0.8.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]