Skip to content
Threat Feed
Subscribe

Product

Brace-Expansion (<= 5.0.7)

1 brief RSS
low advisory

Denial of Service via Unbounded Expansion Length in Node.js brace-expansion Library (CVE-2026-14257)

An attacker can exploit CVE-2026-14257, a denial of service vulnerability in the `brace-expansion` Node.js library, by crafting an input with deeply chained brace groups that causes the expanded string length to grow without bound, leading to an uncatchable out-of-memory process crash in any application processing untrusted input via `expand()` directly or through dependencies like `minimatch` or `glob`.

brace-expansion denial-of-service vulnerability node.js software-supply-chain
1t 1c