Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

brace-expansion can crash Node.js apps with memory overload

CVE-2026-14257 · published 3 months ago
Summary

The brace-expansion library used in Node.js (including the Debian, juliangruber, rootio, and similar packages) can run out of memory when an attacker supplies a specially crafted pattern, causing the process to stop unexpectedly. This happens because the library limits how many results it creates but does not limit how long each result can become, allowing a small input to consume huge amounts of memory. Upgrade to version 5.0.8 or later, or configure the new maxLength setting, to prevent the crash.

What to do
  • Update juliangruber brace-expansion to version 5.0.8.
  • Update rootio @rootio/brace-expansion to version 1.1.12-root.io.3.
  • Update juliangruber brace-expansion to version 1.1.12-aikido.3.
  • Update rootio @rootio/brace-expansion to version 5.0.4-root.io.4.
  • Update juliangruber brace-expansion to version 5.0.4-aikido.4.
  • Update rootio @rootio/brace-expansion to version 5.0.7-root.io.1.
  • Update juliangruber brace-expansion to version 5.0.7-aikido.1.
  • Update rootio @rootio/brace-expansion to version 2.1.0-root.io.3.
  • Update juliangruber brace-expansion to version 2.1.0-aikido.3.
  • Update juliangruber brace-expansion to version 1.1.16-aikido.2.
  • Update rootio @rootio/brace-expansion to version 1.1.16-root.io.2.
  • Update rootio @rootio/brace-expansion to version 2.1.0-root.io.4.
  • Update juliangruber brace-expansion to version 2.1.0-aikido.4.
  • Update juliangruber brace-expansion to version 5.0.7-aikido.2.
  • Update rootio @rootio/brace-expansion to version 5.0.7-root.io.2.
  • Update juliangruber brace-expansion to version 5.0.8-aikido.1.
  • Update rootio @rootio/brace-expansion to version 5.0.8-root.io.1.
  • Update juliangruber brace-expansion to version 3.0.3.
  • Update juliangruber brace-expansion to version 2.1.3.
  • Update juliangruber brace-expansion to version 1.1.17.
  • Update brace-expansion to version 5.0.8-aikido.1.
  • Update brace-expansion to version 5.0.8-aikido.2.
  • Update rootio @rootio/brace-expansion to version 5.0.8-root.io.2.
  • Update brace-expansion to version 5.0.8-aikido.3.
  • Update rootio @rootio/brace-expansion to version 5.0.8-root.io.3.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian node-brace-expansion All versions
Debian:12 debian node-brace-expansion All versions
Debian:13 debian node-brace-expansion All versions
Debian:14 debian node-brace-expansion All versions
– juliangruber brace-expansion <= 5.0.7
< 1.1.17
>= 2.0.0, < 2.1.3
>= 3.0.0, < 3.0.3
>= 4.0.0, < 5.0.8
npm juliangruber brace-expansion <= 5.0.7
>= 4.0.0, < 5.0.8
>= 3.0.0, < 3.0.3
>= 2.0.0, < 2.1.3
< 1.1.17
Fix: upgrade to 5.0.8
Root:npm rootio @rootio/brace-expansion < 1.1.12-root.io.3
< 5.0.4-root.io.4
< 5.0.7-root.io.1
< 2.1.0-root.io.3
< 1.1.16-root.io.2
< 2.1.0-root.io.4
< 5.0.7-root.io.2
< 5.0.8-root.io.1
< 5.0.8-root.io.2
< 5.0.8-root.io.3
Fix: upgrade to 1.1.12-root.io.3
Root:npm juliangruber brace-expansion < 1.1.12-aikido.3
< 5.0.4-aikido.4
< 5.0.7-aikido.1
< 2.1.0-aikido.3
< 1.1.16-aikido.2
< 2.1.0-aikido.4
< 5.0.7-aikido.2
< 5.0.8-aikido.1
Fix: upgrade to 1.1.12-aikido.3
Root:npm – brace-expansion < 5.0.8-aikido.1
< 5.0.8-aikido.2
< 5.0.8-aikido.3
Fix: upgrade to 5.0.8-aikido.1
Ubuntu:18.04:LTS canonical node-brace-expansion All versions
Original advisory text
brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published23 Jul 2026
Updated4 Nov 2026
First seen23 Jul 2026
Sources
DEBIAN-CVE-2026-14257 · OSV
CVE-2026-14257 · NVD
CVE-2026-14257 · MITRE
GHSA-mh99-v99m-4gvg · GHSA
CVE-2026-14257 · OSV
ROOT-APP-NPM-CVE-2026-14257 · OSV
UBUNTU-CVE-2026-14257 · OSV
Track software like this
Free during beta