CVE-2026-14257

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.

A flaw was found in the brace-expansion npm package. The expand() function limits the number of generated results but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the result count under the limit while making each result progressively longer, causing total memory consumption to grow until the Node.js process crashes with an uncatchable out-of-memory error. This affects any application that passes attacker-influenced strings to brace-expansion directly or transitively via minimatch or glob brace patterns.

Note: In the majority of Red Hat products, brace-expansion is brought in as a transitive dependency of minimatch or glob and is not used at runtime. It is typically only invoked during build or development tooling and is not directly exposed to untrusted network input, reducing the practical exploitability of this flaw.

$ npm ls --omit=dev brace-expansion
[email protected] /usr/lib/node_modules/npm
`-- [email protected]
  `-- [email protected]

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not pass untrusted or user-controlled input to brace-expansion's expand() function or to libraries that use it for glob pattern matching (such as minimatch or glob). Validate and sanitize any brace patterns before expansion.

Where possible, upgrade to brace-expansion 1.1.17, 2.1.3, 3.0.3, or 5.0.8 which add a maxLength option that bounds accumulated output.

As an additional defense-in-depth measure, enforce memory limits on Node.js processes using operating system resource controls such as cgroups or Kubernetes resource limits (spec.containers[].resources.limits.memory) to prevent a single process from exhausting system memory and causing a wider outage.