brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

CLEANSTART-2026-WO90836 Security fixes in langfuse-worker 3.224.2-r2

Package langfuse-worker version 3.224.2-r2 fixes 3 vulnerabilities: ghsa-9mqv-5hh9-4cgg, CVE-2026-14257, CVE-2026-69152...

CLEANSTART-2026-ZB73544 Security fixes in langfuse-worker 3.224.0-r2

Package langfuse-worker version 3.224.0-r2 fixes 2 vulnerabilities: CVE-2026-14257, CVE-2026-69152...

CLEANSTART-2026-UX73923 Security fixes in langfuse-worker 3.224.1-r1

Package langfuse-worker version 3.224.1-r1 fixes 25 vulnerabilities: CVE-2026-69152, CVE-2026-14257, ghsa-55q2-fjhq-7xh7, CVE-2026-18446, CVE-2026-69207...

CLEANSTART-2026-XV83516 Security fixes in langfuse-worker 3.224.2-r3

Package langfuse-worker version 3.224.2-r3 fixes 2 vulnerabilities: CVE-2026-69152, CVE-2026-14257...

CLEANSTART-2026-ZG72732 Security fixes in langfuse-worker 4.0.0-r2

Package langfuse-worker version 4.0.0-r2 fixes 2 vulnerabilities: CVE-2026-14257, CVE-2026-69152...

CLEANSTART-2026-GT14873 Security fixes in langfuse-worker 3.224.0-r3

Package langfuse-worker version 3.224.0-r3 fixes 2 vulnerabilities: CVE-2026-14257, CVE-2026-69152...

CLEANSTART-2026-TV56088 Security fixes in langfuse-worker 3.225.0-r2

Package langfuse-worker version 3.225.0-r2 fixes 3 vulnerabilities: CVE-2026-14257, CVE-2026-69152, ghsa-9mqv-5hh9-4cgg...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

nodejs:24 security update

nodejs 1:24.18.0-6 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257 fixed in 5.0.8. 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - deps: update sqlite to 3.53.4...

RockyLinux 10 : nodejs22 (RLSA-2026:55541)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55541 advisory. brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand function CVE-2026-14257 brace-expansion: brace-expansion: Denial of...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs26: nodejs26-26.7.0-1.5.2.hum1 aarch64, x8664 nodejs26-bin-26.7.0-1.5.2.hum1 noarch nodejs26-devel-26.7.0-1.5.2.hum1 aarch64, x8664 nodejs26-docs-26.7.0-1.5.2.hum1 noarch...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.1-0.2.1.hum1 aarch64, x8664 nodejs24-bin-24.18.1-0.2.1.hum1 noarch nodejs24-devel-24.18.1-0.2.1.hum1 aarch64, x8664 nodejs24-docs-24.18.1-0.2.1.hum1 noarch...

DoS (Denial of Service) brace-expansion Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.5, 10.0.0, 10.1.1, 10.2.0, 10.3.2, and 10.4.1 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

A flaw was found in the brace-expansion library. The expand function does not apply maxLength when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is...