CVE-2026-14257
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales until the process hits a fatal out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000).
Risk Assessment
Risk of application crash from a small request, potentially leading to denial of service (DoS).
Recommendation
Upgrade the brace-expansion library to version 5.0.8 or later.
Other vulnerabilities in brace-expansion
See all- CVE-2025-5889Low
A vulnerability was found in the brace-expansion library up to versions 1.1.11, 2.0.1, 3.0.0, and 4.0.0, involving inefficient regular expression complexity in the expand function in index.js. The attack can be launched remotely.
- CVE-2026-69152High
The brace-expansion library prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9 contains a vulnerability where the expand() function does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the event loop.
- CVE-2026-13149High
A vulnerability in brace-expansion up to version 5.0.6 allows a DoS attack by sending a crafted string with many consecutive non-expanding '{}' brace groups. The expand() function has exponential time complexity, causing high CPU consumption and event-loop blocking.
- CVE-2026-45149Medium
The brace-expansion library versions 5.0.0 to before 5.0.6 apply the max option too late, causing excessive memory (~505 MB) and CPU (~800 ms) usage when expanding large numeric ranges. Fixed in version 5.0.6.
Original NVD description (English source)
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.