CVE-2026-14257: CWE-400 Uncontrolled Resource Consumption in juliangruber brace-expansion
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
AI Analysis
Technical Summary
CVE-2026-14257 describes a denial of service vulnerability in the juliangruber brace-expansion library versions up to 5.0.7. The expand() function limits the number of expanded results with a max option (default 100,000) but does not limit the length of each expanded string. An attacker can chain multiple brace groups to keep the result count under the limit while making each result string longer, causing total memory usage to grow until the Node.js process crashes with an out-of-memory error. Approximately 7.5 KB of crafted input can trigger this crash. The vulnerability affects any application passing attacker-controlled strings to brace-expansion.expand(), including indirectly via minimatch or glob patterns. The issue is fixed in version 5.0.8 by introducing a maxLength option (default 4,000,000) that bounds the total output and intermediate array sizes.
Potential Impact
Successful exploitation results in a denial of service due to memory exhaustion causing the Node.js process to crash. There is no impact on confidentiality or integrity, only availability is affected. This can disrupt applications that use brace-expansion for pattern matching or string expansion when processing untrusted input.
Mitigation Recommendations
A fix is available in juliangruber brace-expansion version 5.0.8 which adds a maxLength option to limit memory usage. Users should upgrade to version 5.0.8 or later to remediate this vulnerability. Until upgraded, avoid passing untrusted input to the expand() function or any dependent libraries that use brace-expansion for pattern expansion.
CVE-2026-14257: CWE-400 Uncontrolled Resource Consumption in juliangruber brace-expansion
Description
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14257 describes a denial of service vulnerability in the juliangruber brace-expansion library versions up to 5.0.7. The expand() function limits the number of expanded results with a max option (default 100,000) but does not limit the length of each expanded string. An attacker can chain multiple brace groups to keep the result count under the limit while making each result string longer, causing total memory usage to grow until the Node.js process crashes with an out-of-memory error. Approximately 7.5 KB of crafted input can trigger this crash. The vulnerability affects any application passing attacker-controlled strings to brace-expansion.expand(), including indirectly via minimatch or glob patterns. The issue is fixed in version 5.0.8 by introducing a maxLength option (default 4,000,000) that bounds the total output and intermediate array sizes.
Potential Impact
Successful exploitation results in a denial of service due to memory exhaustion causing the Node.js process to crash. There is no impact on confidentiality or integrity, only availability is affected. This can disrupt applications that use brace-expansion for pattern matching or string expansion when processing untrusted input.
Mitigation Recommendations
A fix is available in juliangruber brace-expansion version 5.0.8 which adds a maxLength option to limit memory usage. Users should upgrade to version 5.0.8 or later to remediate this vulnerability. Until upgraded, avoid passing untrusted input to the expand() function or any dependent libraries that use brace-expansion for pattern expansion.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- seal
- Date Reserved
- 2026-06-30T15:45:06.757Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6215a29c2644c7f82072c2
Added to database: 07/23/2026, 13:22:42 UTC
Last enriched: 07/23/2026, 13:37:03 UTC
Last updated: 07/24/2026, 03:47:56 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.