The advisory covers three CVEs affecting Red Hat Hardened Images RPMs, notably CVE-2026-14257, a denial of service vulnerability in the brace-expansion npm package. The expand() function does not limit the length of generated strings, allowing an attacker to cause unbounded memory consumption by chaining brace groups, leading to an out-of-memory crash of the Node.js process. This affects applications that pass attacker-controlled input to brace-expansion directly or via minimatch or glob. The vulnerability is mostly relevant during build or development tooling and is not typically exposed to untrusted network input in Red Hat products. The advisory includes updated grafana12.4 RPMs (version 12.4.6-0.4.hum1) for aarch64 and x86_64 architectures. The vendor recommends avoiding untrusted input to brace-expansion, upgrading brace-expansion to versions with a maxLength option, and applying resource limits to Node.js processes. No explicit patch for brace-expansion is included in this advisory; the update is for Red Hat Hardened Images containing the affected components.

The vulnerability allows a remote attacker to cause a denial of service by triggering excessive memory consumption in the expand() function of the brace-expansion package, crashing the Node.js process with an uncatchable out-of-memory error. This impacts availability but does not affect confidentiality or integrity. The flaw is exploitable when untrusted input reaches the vulnerable function, which is uncommon in most Red Hat products since brace-expansion is typically used only during build or development tooling and not exposed to untrusted network input. The update addresses these issues in the context of Red Hat Hardened Images RPMs including grafana12.4.

Red Hat provides updated RPM packages for grafana12.4 as part of the Hardened Images update. Users should apply these updates to incorporate the fixes. Additionally, do not pass untrusted or user-controlled input to brace-expansion's expand() function or libraries that use it (such as minimatch or glob). Validate and sanitize any brace patterns before expansion. Where possible, upgrade brace-expansion to versions 1.1.17, 2.1.3, 3.0.3, or 5.0.8, which add a maxLength option to limit output size. As a defense-in-depth measure, enforce memory limits on Node.js processes using OS resource controls like cgroups or Kubernetes resource limits to prevent system-wide outages. Patch status for brace-expansion itself is not explicitly stated in this advisory; check vendor sources for updates.