Vulnerabilities

The brace-expansion npm library's expand() function fails to enforce maxLength while building comma-alternative intermediate arrays and padded sequences, allowing attacker-supplied brace patterns to consume unbounded memory or block the Node.js event loop. An attacker who can control the strings passed to the library — typically via an application that expands user-supplied glob-like patterns — can trigger a denial of service, with no confidentiality or integrity impact. The flaw affects all versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, and notably bypasses the earlier fix for CVE-2026-14257, so users who already applied that patch remain vulnerable. Because brace-expansion is almost always pulled in as a transitive dependency (e.g., via minimatch), the affected population is broad across the Node.js ecosystem, though only applications that feed untrusted input into the library are practically exploitable. No in-the-wild exploitation is currently known; a public advisory (GHSA-rgw5-rvv9-x895) is available and EPSS estimates a 0.6% chance of exploitation within 30 days.

Do: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, or 5.0.9 depending on your major version branch, and re-run npm audit or a lockfile scan to locate transitive copies — patching CVE-2026-14257 alone is not sufficient. Where upgrading is not immediately possible, validate or length-limit user-supplied patterns before passing them to expand(), and prioritize remediation for internet-facing services that process untrusted glob-like strings.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.