CVE-2026-14257 juliangruber CVE debrief

Who should care

Developers and administrators of applications using brace-expansion, especially those accepting user-influenced input, should be aware of this vulnerability and take steps to mitigate the risk.

Technical summary

The expand() function in brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. An attacker can cause a fatal out-of-memory error by chaining multiple brace groups with progressively longer result strings, despite the max option limiting the number of results. This issue was fixed in version 5.0.8 by introducing a maxLength option that bounds accumulated output and intermediate arrays. The vulnerability has a high CVSS score of 7.5 and can cause denial of service via memory exhaustion. Immediate attention is required to mitigate the risk. The expand() function does not bound the length of each result string, leading to potential memory exhaustion. A fix was introduced in version 5.0.8 by adding a maxLength option. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. The vulnerability affects brace-expansion, a popular npm package used for expanding brace patterns in strings. This vulnerability can lead to denial of service (DoS) attacks via memory exhaustion. Developers and administrators of applications using brace-expansion, especially those accepting user-influenced input, should be aware of this vulnerability and take steps to mitigate the risk. The CVE record was published on 2026-07-23T14:17:00.250Z and has not been modified since then. The official CVE Program record and NIST NVD detail page provide additional information on this vulnerability. Product references and patch information are also available from the source. Compensating controls, such as input length limits or monitoring for suspicious activity, can be implemented for applications unable to update immediately. Incident response plans should be in place to respond to potential denial of service attempts. The vulnerability can be exploited by chaining multiple brace groups with progressively longer result strings, despite the max option limiting the number of results. The fix introduces a maxLength option that bounds accumulated output and intermediate. A

Defensive priority

This vulnerability has a high CVSS score of 7.5 and can cause denial of service via memory exhaustion. Immediate attention is required to mitigate the risk.

Recommended defensive actions

• Inventory and triage: Identify and review applications that use brace-expansion, especially those accepting user-influenced input.
• Patch or upgrade: Update brace-expansion to version 5.0.8 or later to apply the maxLength fix.
• Implement compensating controls: For applications unable to update immediately, consider using input length limits or monitoring for suspicious activity.
• Monitor and respond: Watch for potential denial of service attempts and have incident response plans in place.
• Review and verify: Validate affected scope, severity, and vendor guidance for brace-expansion.
• Asset inventory: Identify and document all systems and applications using brace-expansion.
• Source tracking: Monitor for updates and advisories from the vendor and other sources.

Evidence notes

The expand() function in brace-expansion through 5.0.7 does not bound the length of each result string, leading to potential memory exhaustion. A fix was introduced in version 5.0.8 by adding a maxLength option.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.