NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

🗓️ 24 Jul 2026 21:53:14Reported by PatchstackType

Brace-expansion DoS in Node package manager versions up to five point zero seven caused by unbounded expansion length leading to memory crash.

Reporter	Title	Published	Views	Family All 687
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	20 Aug 202615:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cyber Fraud includes components with multiple known vulnerabilities	20 Aug 202614:58	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202605:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to CVE-2026-14257.	27 Aug 202619:26	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in cyclops of IBM Netezza Appliance	7 Sep 202606:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.16.tgz which is vulnerable to multiple CVEs.	27 Aug 202619:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities found in IBM DataPower Interact Gateway 12.1.1.1	2 Sep 202613:38	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.	7 Sep 202611:00	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in brace-expansion	19 Aug 202616:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in brace-expansion affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	25 Aug 202618:11	–	ibm

Vulners

Node

npm brace-expansionRange≤1.1.17

Source	Link
github	www.github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-14257
github	www.github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5
github	www.github.com/juliangruber/brace-expansion
npmjs	www.npmjs.com/package/brace-expansion
github	www.github.com/advisories/GHSA-mh99-v99m-4gvg
github	www.github.com/juliangruber/brace-expansion/pull/129
github	www.github.com/juliangruber/brace-expansion/pull/130
github	www.github.com/juliangruber/brace-expansion/pull/136
github	www.github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d

24 Jul 2026 21:53Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.5

EPSS0.00466

SSVC