Skip to main content

brace-expansion CVE-2026-14257

| EUVDEUVD-2026-48285 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-07-23 seal GHSA-mh99-v99m-4gvg
Denial Of Service Node.js Brace Expansion
7.5
CVSS 3.1 · Vendor: seal
Share

Severity by source

Vendor (seal) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Small unauthenticated network input crashes the process with an uncatchable OOM, giving availability-only impact (A:H), no confidentiality or integrity effect, and low attack complexity.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (seal).

CVSS VectorVendor: seal

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 13:52 vuln.today
Analysis Generated
Jul 23, 2026 - 13:52 vuln.today
CVE Published
Jul 23, 2026 - 12:54 cve.org
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2,867 npm packages depend on brace-expansion (65 direct, 2,826 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Articles & Coverage 2

News 3 New Node.js Vulnerabilities - 3 High Severity, 1 With POC Jul 24, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Jul 23, 2026

AnalysisAI

Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.

Technical ContextAI

brace-expansion implements Bash-style brace expansion (e.g. '{a,b,c}' -> 'a','b','c') and is a foundational dependency of minimatch and node-glob, which underpin a large fraction of Node.js tooling and filesystem glob matching. The root cause is CWE-400 (Uncontrolled Resource Consumption): the combining logic in expand_() bounded only the number of emitted expansions (EXPANSION_MAX = 100,000) and never bounded the cumulative character length of the accumulator or the intermediate arrays built while combining brace sets. Since total output size is the product of result count and per-result length, chaining many small comma groups makes each result grow linearly (~1500 chars for 1500 chained groups) while the count stays under the cap, so the accumulator and intermediate arrays scale multiplicatively until the V8 heap is exhausted. The affected package is identified by CPE cpe:2.3:a:juliangruber:brace-expansion.

RemediationAI

Upgrade brace-expansion to 5.0.8 or later, which introduces a maxLength option (default 4,000,000 characters) that bounds accumulated output and intermediate arrays so memory stays flat regardless of how many brace groups are chained (Vendor-released patch: 5.0.8, commit https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5). Because the package is almost always a transitive dependency, run 'npm ls brace-expansion' and force the resolved version up via an npm 'overrides' (or Yarn 'resolutions') entry, then rebuild lockfiles, since updating minimatch/glob alone may not immediately pull the patched release. If you cannot upgrade immediately, constrain exposure by validating or length-capping any user-supplied string before it reaches expand() (reject inputs above a few hundred bytes or containing many brace groups) and by isolating glob/minimatch calls in worker processes with request-size limits so an OOM crash does not take down the main service; the trade-off is that aggressive input caps can reject legitimate complex patterns and worker isolation adds operational overhead. On 5.0.8+ you can also pass an explicit lower maxLength to expand()/minimatch call sites that handle untrusted input for defense in depth.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2016-2107 MEDIUM POC
5.9 May 05

The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-14257 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy