High · published August 3, 2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
| Product | Versions | Fixed in |
|---|---|---|
| juliangruber/brace-expansion | < 1.1.18 | 1.1.18 |
| juliangruber/brace-expansion | ≥ 2.0.0, < 2.1.4 | 2.1.4 |
| juliangruber/brace-expansion | ≥ 3.0.0, < 3.0.6 | 3.0.6 |
| juliangruber/brace-expansion | ≥ 4.0.0, < 5.0.9 | 5.0.9 |