Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-14257: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion

44
This month
HIGH 7.5REMOTEUPGRADE

CVE-2026-14257 is a high-severity flaw (CVSS 7.5) affecting brace-expansion. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal,

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.6% (top 50%)
CISA exploited listNo
WeaknessCWE-400, CWE-770
Published2026-07-23
Last modified2026-10-24
Publisher (CNA): seal · Vendor: juliangruber

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

juliangruber brace-expansion UPGRADE
Affected: < 1.1.17 · >= 2.0.0 and < 2.1.3 · >= 3.0.0 and < 3.0.3 · >= 4.0.0 and < 5.0.8
Fixed in: 1.1.17, 2.1.3, 3.0.3, 5.0.8
Safe to downgrade to: a release before 2.0.0
1. Check installed version
npm ls brace-expansion
2. UPGRADE to 1.1.17
npm install brace-expansion@">=1.1.17"
3. If no update is available yet, DOWNGRADE to a release before 2.0.0
npm view brace-expansion versions npm install brace-expansion@"<2.0.0"
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

npm · brace-expansion · FIXED · 5.0.8 · vulnerable: >= 4.0.0, < 5.0.8 · source
npm install brace-expansion@">=5.0.8" npm ls brace-expansion
Fedora 46 · gnome-shell-extension-tiling-assistant · FIXED · 56-1.fc46 · FEDORA-2026-ebf66a5321 · source
sudo dnf upgrade --advisory=FEDORA-2026-ebf66a5321
Debian 12 · node-brace-expansion · NO FIX YET
Debian 13 · node-brace-expansion · NO FIX YET
RHEL 10 · nodejs22 · FIXED · nodejs22-22.23.1-6.el10_2
sudo dnf upgrade --advisory=RHSA-2026:55541 rpm -q nodejs22
RHEL 10 · rh-podman-desktop · FIXED · rh-podman-desktop-1.1.2-1.el10_2
sudo dnf upgrade --advisory=RHSA-2026:57590 rpm -q rh-podman-desktop
RHEL 10 · nodejs24 · FIXED · nodejs24-24.18.0-5.el10_2
sudo dnf upgrade --advisory=RHSA-2026:58819 rpm -q nodejs24
RHEL 10.0 Extended Update Support · nodejs22 · FIXED · nodejs22-22.23.2-1.el10_0
sudo dnf upgrade --advisory=RHSA-2026:64817 rpm -q nodejs22
RHEL 10 · nodejs-nodemon · NOT AFFECTED
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-14257?

brace-expansion: upgrade to 1.1.17, 2.1.3, 3.0.3, 5.0.8. Exact commands for each OS are on this page.

Is CVE-2026-14257 being exploited?

CVE-2026-14257 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-14257 affect?

CVE-2026-14257 affects brace-expansion. Severity is high (CVSS 7.5). brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining

How urgent is CVE-2026-14257?

Priority 44/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs