Threat Intelligence Database

This update includes the following RPMs: nodejs24: * nodejs24-24.18.0-0.5.hum1 (aarch64, x86_64) * nodejs24-bin-24.18.0-0.5.hum1 (noarch) * nodejs24-devel-24.18.0-0.5.hum1 (aarch64, x86_64) * nodejs24-docs-24.18.0-0.5.hum1 (noarch) * nodejs24-full-i18n-24.18.0-0.5.hum1 (aarch64, x86_64) * nodejs24-libs-24.18.0-0.5.hum1 (aarch64, x86_64) * nodejs24-npm-11.16.0-1.24.18.0.0.5.hum1 (noarch) * nodejs24-npm-bin-24.18.0-0.5.hum1 (noarch) * v8-13.6-devel-13.6.233.17-1.24.18.0.0.5.hum1 (aarch64, x86_64) * nodejs24-24.18.0-0.5.hum1.src (src)

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

CVE-2026-14257 is a high-severity vulnerability in the juliangruber brace-expansion library (versions up to 5.0.7) that allows an attacker to cause uncontrolled memory consumption. The expand() function limits the number of results but not their length, enabling crafted inputs with many chained brace groups to exhaust memory and crash the Node.js process with an uncatchable out-of-memory error. This denial-of-service condition cannot be caught by try/catch and results in a fatal process termination. The vulnerability affects applications that pass attacker-controlled strings to brace-expansion.expand(), including via minimatch or glob patterns. A patch has been released that bounds the total output length to prevent unbounded memory growth.