CVE-2026-14257

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 5.0.8

Description An issue exists that allows a denial of service via memory exhaustion. The expand() function limits the number of results using a max option, but it does not restrict the length of each individual result string. An attacker can chain multiple brace groups to keep the total result count below the limit while increasing the length of each result, causing memory usage to scale until the process encounters a fatal out-of-memory error. This can affect any application passing attacker-influenced strings to expand(), whether directly or transitively through minimatch or glob brace patterns.

Recommendations Update to version 5.0.8.