The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9, the expand() function does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by this vulnerabi [truncated]
The CVE-2026-14257 vulnerability affects brace-expansion, a popular npm package used for expanding brace patterns in strings. This vulnerability can lead to denial of service (DoS) attacks via memory exhaustion. The expand() function in brace-expansion through version 5.0.7 does not limit the length of each result string, allowing an attacker to cause a fatal out-of-memory error by chaining multiple brace [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-30T10:16:34.560Z and has not been modified since then. The NVD entry is currently Deferred. This denial of service vulnerability affects brace-expansion through 5.0.6, allowing an attacker to cause significant CPU consumption and event-loop blocking by passing a crafted string to expand(), directly [truncated]
A vulnerability in the brace-expansion library (versions 5.0.0 to before 5.0.6) allows uncontrolled resource consumption when processing large numeric range patterns. The library's max option, intended to limit output size, is applied too late in the expansion process. When expanding a pattern like {1..10000000}, the library generates all 10 million intermediate elements before enforcing the limit, causin [truncated]
