CVE-2026-14257High· 7.5▾ TwilightA flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) b…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 24.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
0.3% → 0.6%
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function — rated Important by Red Hat. Released 2026-07-23, updated 2026-09-09.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:64817 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:55541 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:58819
Workarounds / mitigations:
Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.
As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as…
Affected packages:
brace-expansion <= 5.0.7Patched in:
brace-expansion 5.0.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69152High· 7.5brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152)
CVE-2026-69192High· 8.6ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
CVE-2026-59873High· 7.5tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)
CVE-2026-59874High· 7.5tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
CVE-2026-12151High· 7.5undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
CVE-2022-3064High· 7.5go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)