Skip to main content

brace-expansion CVE-2026-14257

| EUVDEUVD-2026-48285 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-23 seal GHSA-mh99-v99m-4gvg
Denial Of Service Node.js Brace Expansion Suse
7.5
CVSS 3.1 · Vendor: seal
Share

Severity by source

Vendor (seal) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Small unauthenticated network input crashes the process with an uncatchable OOM, giving availability-only impact (A:H), no confidentiality or integrity effect, and low attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (seal).

CVSS VectorVendor: seal

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 13:52 vuln.today
Analysis Generated
Jul 23, 2026 - 13:52 vuln.today
CVE Published
Jul 23, 2026 - 12:54 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2,867 npm packages depend on brace-expansion (65 direct, 2,826 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Articles & Coverage 2

News 3 New Node.js Vulnerabilities - 3 High Severity, 1 With POC Jul 24, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Jul 23, 2026

AnalysisAI

Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Find endpoint feeding input to glob/minimatch
Delivery
Craft chained brace string ({a,b}x1500)
Exploit
Submit ~7.5 KB request
Execution
expand() grows accumulator unbounded
Persist
Node heap exhausted, uncatchable OOM
Impact
Process crash, denial of service
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application pass an attacker-influenced string into brace-expansion.expand(), directly or transitively via minimatch/glob brace-pattern matching, on a version through 5.0.7; the malicious input must contain many chained brace groups (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a pure availability impact reachable over the network with low complexity and no authentication or user interaction, consistent with the description of a small request crashing a default process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a small HTTP request (about 7.5 KB) containing a value like '{a,b}' repeated ~1500 times to an endpoint that eventually passes the string into brace-expansion.expand(), for example through a glob or minimatch brace pattern used for filtering or path matching. The library builds an ever-larger accumulator until the Node.js heap is exhausted and the process dies with an uncatchable out-of-memory error, taking the service down. …
Remediation Upgrade brace-expansion to 5.0.8 or later, which introduces a maxLength option (default 4,000,000 characters) that bounds accumulated output and intermediate arrays so memory stays flat regardless of how many brace groups are chained (Vendor-released patch: 5.0.8, commit https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Node.js applications and dependencies using brace-expansion, minimatch, or glob to identify exposure scope and affected versions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Node.js

View all
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
CVE-2013-4450 MEDIUM POC
5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-14257 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy