CVE-2026-14257
Received Received - Intake

Denial of Service in brace-expansion Library

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: seal

Description
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-14257
EUVD
EUVD-2026-48285

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
juliangruber brace-expansion to 5.0.8 (exc)
juliangruber brace-expansion 5.0.8
juliangruber brace-expansion 4.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in the brace-expansion library (versions up to 5.0.7). It allows attackers to crash applications by sending specially crafted input that causes unbounded memory growth. The flaw occurs because the library limits the number of expansion results but not the length of each result string. By chaining many brace groups, an attacker can keep the result count under the limit while making each result progressively longer, leading to excessive memory consumption until the process crashes.

Detection Guidance

To detect this vulnerability, monitor for applications using brace-expansion versions before 5.0.8. Check for processes consuming excessive memory or crashing due to large brace expansions. Use commands like 'npm list brace-expansion' or 'grep -r "brace-expansion" /path/to/project' to identify vulnerable dependencies.

Impact Analysis

This vulnerability can impact you if you use applications that rely on brace-expansion, such as those using minimatch or glob patterns. An attacker could send a small malicious request (about 7.5 KB) to crash the application, causing a denial of service. This could disrupt services, lead to downtime, or require manual intervention to restart the affected process.

Mitigation Strategies

Immediately update brace-expansion to version 5.0.8 or later. If updating is not possible, implement input validation to limit brace pattern length and complexity. Disable or restrict applications using brace-expansion until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart