Denial of Service Vulnerability in Brace-Expansion by Juliangruber

CVE-2026-14257

What is CVE-2026-14257?

The brace-expansion library, specifically version 5.0.7, is susceptible to a denial of service attack due to unbounded memory usage when processing input strings. The expand() function allows for the generation of a high number of result strings, but it lacks restrictions on their individual lengths. This flaw can be exploited by attackers who craft specific inputs, leading to excessive memory consumption that ultimately crashes the application. A fix introduced in version 5.0.8 adds a maxLength option to limit output size and prevent such attacks.

References