brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

🗓️ 24 Jul 2026 21:53:14Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 169 Views

Brace expansion DoS: unbounded result length grows with groups, exhausting memory despite a maximum result cap.

Reporter	Title	Published	Views	Family All 687
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	20 Aug 202615:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities	20 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257.	27 Aug 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	7 Sep 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.	27 Aug 202619:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1	2 Sep 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	7 Sep 202611:00	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion	19 Aug 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in brace-expansion affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:11	–	ibm

Vulners

Node

juliangruber brace-expansionRange<1.1.17npm

juliangruber brace-expansionRange2.0.0–2.1.3npm

juliangruber brace-expansionRange3.0.0–3.0.3npm

juliangruber brace-expansionRange4.0.0–5.0.8npm

Source	Link
github	www.github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-14257
github	www.github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
github	www.github.com/juliangruber/brace-expansion
npmjs	www.npmjs.com/package/brace-expansion
github	www.github.com/juliangruber/brace-expansion/pull/129
github	www.github.com/juliangruber/brace-expansion/pull/130
github	www.github.com/juliangruber/brace-expansion/pull/136
github	www.github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
github	www.github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031

31 Jul 2026 19:37Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00466

SSVC