Source: node-brace-expansion
Version: 2.0.3+~1.1.2-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for node-brace-expansion.
CVE-2026-14257[0]:
| brace-expansion through 5.0.7 is vulnerable to denial of service via
| memory exhaustion. The expand() function limits the number of
| results with a max option (default 100,000) but does not bound the
| length of each result string. By chaining multiple brace groups, an
| attacker keeps the result count under the limit while making each
| result progressively longer, so total memory scales with both count
| and string length until the process hits a fatal, uncatchable out-
| of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500))
| crashes a default Node.js process. Any application that passes
| attacker-influenced strings to brace-expansion.expand() - directly
| or transitively via minimatch / glob brace patterns - can be crashed
| by a small request. Fixed in 5.0.8 by adding a maxLength option
| (default 4,000,000) that bounds accumulated output and intermediate
| arrays.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-14257
https://www.cve.org/CVERecord?id=CVE-2026-14257
[1]
https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
