Skip to content
Fencer Intel
high 7.5

CVE-2026-14257 json

brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash

published 3mo ago modified 16d ago also GHSA-mh99-v99m-4gvg , EUVD-2026-48285

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

Patch / fix

  • npm brace-expansion 1.1.17, 2.1.3, 3.0.3, 5.0.8
  • juliangruber brace-expansion 1.1.17, 2.1.3, 3.0.3, 5.0.8
  • npm RHEL 9 1:11.16.0-1.24.18.0.6.module+el9.8.0+24638+75f46aee
  • nodejs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-libs RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-nodemon RHEL 9 3.1.14-3.module+el9.8.0+24638+75f46aee
  • nodejs-full-i18n RHEL 9 1:24.18.0-6.module+el9.8.0+24638+75f46aee
  • nodejs-packaging RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • nodejs-packaging-bundler RHEL 9 2021.06-6.module+el9.8.0+24355+35d95b59
  • npm RHEL 9 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5

red hat advisories RHSA-2026:64817RHSA-2026:62416RHSA-2026:55603RHSA-2026:55601RHSA-2026:54530RHSA-2026:54371

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1

opensuse advisories openSUSE-SU-2026:12070-1

  • nodejs24 AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-npm AlmaLinux 10 1:11.16.0-1.24.18.0.5.el10_2
  • nodejs24-libs AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-full-i18n AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-npm AlmaLinux 10 1:10.9.8-1.22.23.1.6.el10_2
  • nodejs-libs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-full-i18n AlmaLinux 10 1:22.23.1-6.el10_2

almalinux advisories ALSA-2026:58819ALSA-2026:55541ALSA-2026:55601ALSA-2026:55603ALSA-2026:54530ALSA-2026:54371

  • nodejs Rocky Linux 9 1:22.23.1-3.module+el9.8.0+40280+057606e8
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40264+d9b257bb
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40280+057606e8
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597
  • nodejs Rocky Linux 9 1:24.18.0-6.module+el9.8.0+40281+14cc6568

rocky linux advisories RLSA-2026:55601RLSA-2026:55603RLSA-2026:54371RLSA-2026:54530RLSA-2026:58819RLSA-2026:55541

Is CVE-2026-14257 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-14257 updated cvss 7.5

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2 automation-eda-controller
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Hardened Images nodejs20 20.20.2-1.hum1, nodejs25 25.9.0-1.3.hum1
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Container Platform 5 openshift5/ose-monitoring-plugin-rhel9, openshift5/nmstate-console-plugin-rhel9, openshift5/ose-agent-installer-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix available
show 30 more
  • Red Hat Single Sign-On 7 brace-expansion
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188, ansible-automation-platform/bootc-automation-portal-rhel9 1788943531
    fixed: vendor fix RHSA-2026:56357
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1787229385
    fixed: vendor fix RHSA-2026:59159
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/lightspeed-rhel9 1787244079
    fixed: vendor fix RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1788918510
    fixed: vendor fix RHSA-2026:67279
  • Red Hat Discovery 2 discovery/discovery-ui-rhel9 1786634825
    fixed: vendor fix RHSA-2026:54760
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs 24.18.0-3.module+el8.10.0+24639+56878497, nodejs-libs 22.23.1-3.module+el8.10.0+24640+6eba5e6e, nodejs-libs 24.18.0-3.module+el8.10.0+24639+56878497, npm 10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e, nodejs-nodemon 3.1.14-2.module+el8.10.0+24639+56878497, +8 more
    fixed: vendor fix RHSA-2026:54530
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs 24.18.0-6.module+el9.8.0+24638+75f46aee, nodejs-libs 22.23.1-3.module+el9.8.0+24637+e0b636e5, nodejs-libs 24.18.0-6.module+el9.8.0+24638+75f46aee, npm 10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5, nodejs-nodemon 3.1.14-2.module+el9.8.0+24637+e0b636e5, +8 more
    fixed: vendor fix RHSA-2026:55601
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.23.1-6.el10_2, nodejs22 22.23.1-6.el10_2, nodejs24 24.18.0-5.el10_2, nodejs-libs 22.23.1-6.el10_2, nodejs24-libs 24.18.0-5.el10_2, nodejs-full-i18n 22.23.1-6.el10_2, +3 more
    fixed: vendor fix RHSA-2026:55541
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.23.2-1.el10_0, nodejs22 22.23.2-1.el10_0, nodejs-libs 22.23.2-1.el10_0, nodejs-full-i18n 22.23.2-1.el10_0, nodejs-npm 10.9.8-1.22.23.2.1.el10_0
    fixed: vendor fix RHSA-2026:64817
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-libs 22.23.2-1.module+el9.6.0+24769+299a7e3a, npm 10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a, nodejs-nodemon 3.1.14-2.module+el9.6.0+24789+4011c12f, nodejs-full-i18n 22.23.2-1.module+el9.6.0+24769+299a7e3a, nodejs-packaging 2021.06-4.module+el9.6.0+23473+45664c2d, +1 more
    fixed: vendor fix RHSA-2026:62416
  • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop 1.1.2-1.el10_2
    fixed: vendor fix RHSA-2026:57590
  • Red Hat Hardened Images nodejs26 26.5.0-1.4.hum1, nodejs22 22.23.1-2.3.hum1, nodejs24 24.18.0-0.5.hum1, nodejs26 26.7.0-1.5.2.hum1, grafana12.4 12.4.6-0.4.hum1, nodejs24 24.18.1-0.2.1.hum1, +25 more
    fixed: vendor fix RHSA-2026:50290
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1789546373
    fixed: vendor fix RHSA-2026:68681
  • Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9 1789937643
    fixed: vendor fix RHSA-2026:70588
  • Red Hat OpenShift Container Platform 4.18 openshift4/nmstate-console-plugin-rhel9 1788805723
    fixed: vendor fix RHSA-2026:65853
  • Red Hat OpenShift Container Platform 4.19 openshift4/nmstate-console-plugin-rhel9 1788551802
    fixed: vendor fix RHSA-2026:66372
  • Red Hat OpenShift Container Platform 4.20 openshift4/nmstate-console-plugin-rhel9 1787837308, openshift4/ose-agent-installer-ui-rhel9 1787080927
    fixed: vendor fix RHSA-2026:60447
  • Red Hat OpenShift Container Platform 4.21 openshift4/nmstate-console-plugin-rhel9 1787590372, openshift4/ose-agent-installer-ui-rhel9 1787013388
    fixed: vendor fix RHSA-2026:60478
  • Red Hat OpenShift Container Platform 4.22 openshift4/nmstate-console-plugin-rhel9 1787158095, openshift4/ose-agent-installer-ui-rhel9 1787158231
    fixed: vendor fix RHSA-2026:57367
  • Red Hat Openshift Data Foundation 4.19 odf4/odf-console-rhel9 1793126829
    fixed: vendor fix RHSA-2026:92650
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat OpenShift Service Mesh 3.4 openshift-service-mesh/kiali-rhel9 1787165683, openshift-service-mesh/kiali-ossmc-rhel9 1787166293
    fixed: vendor fix RHSA-2026:59583
  • Red Hat Quay 3.14 quay/quay-rhel8 1788593843
    fixed: vendor fix RHSA-2026:70267
  • Red Hat Cryostat 4 brace-expansion, grafana-infinity-datasource-npm, cryostat-openshift-console-plugin-npm
    not affected: component not present
  • Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8, mta/mta-ui-rhel9, mta/mta-cli-rhel9, mta/mta-generic-external-provider-rhel9
    not affected: vulnerable code not present

54 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
3mo ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm brace-expansion
>=4.0.0, <5.0.8
>=3.0.0, <3.0.3
>=2.0.0, <2.1.3
<1.1.17
5.0.8
3.0.3
2.1.3
1.1.17

Affected products

  • juliangruber brace-expansion

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.