brace-expansion CVE-2026-14257

Exploitation requires that the target application pass an attacker-influenced string into brace-expansion.expand(), directly or transitively via minimatch/glob brace-pattern matching, on a version through 5.0.7; the malicious input must contain many chained brace groups (e.g. '{a,b}' repeated ~1500 times, ~7.5 KB) so per-result length grows while the count stays under the default max of 100,000. No authentication, user interaction, or non-default library configuration is needed (CVSS PR:N/UI:N) and the default install is vulnerable. The limiting factor is reachability: it is only exploitable where untrusted input actually flows into a brace-expansion call, so applications that never expose that code path, or that already length-validate input, are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact reachable over the network with low complexity and no authentication or user interaction, consistent with the description of a small request crashing a default process. No EPSS score or CISA KEV entry was provided, so there is no signal of active exploitation - treat this as no public exploit identified at time of analysis, though a concrete PoC trigger ('{a,b}'.repeat(1500)) is documented in the fix commit and README, lowering the bar to reproduce. Real-world priority hinges on reachability rather than raw score: the network vector only applies where an application actually routes untrusted input into brace-expansion.expand() (directly or via minimatch/glob brace patterns), so for services that never expose that path the effective risk is far below 7.5. Because the crash is an uncatchable OOM, a single small request can down a worker with no code execution or data exposure, making this an availability-only but potentially high-blast-radius issue for exposed Node.js services. No signals in the provided data conflict; the main uncertainty is per-deployment reachability, not the mechanism.

An attacker sends a small HTTP request (about 7.5 KB) containing a value like '{a,b}' repeated ~1500 times to an endpoint that eventually passes the string into brace-expansion.expand(), for example through a glob or minimatch brace pattern used for filtering or path matching. The library builds an ever-larger accumulator until the Node.js heap is exhausted and the process dies with an uncatchable out-of-memory error, taking the service down. A working trigger string is published in the fix commit, so no exploit development is required.