CVE-2026-14257: brace-expansion DoS Vulnerability Leading to Out-of-Memory Crashes
Summary
CVE-2026-14257: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash. Affects brace-expansion versions < 5.0.8. Fixed in 5.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Brace-expansion is a package used in Node.js environments to expand brace patterns into arrays. It allows developers to generate multiple strings from a single pattern, enhancing code efficiency and readability. However, the package has a vulnerability that can lead to denial of service (DoS) by causing the Node.js process to crash due to unbounded memory consumption.
Vulnerability Detail
The vulnerability arises from the expand() function in the brace-expansion package, which limits the number of results it produces but not their length. By chaining multiple brace groups, an attacker can create a scenario where the output size grows indefinitely, leading to an out-of-memory (OOM) error. This results in a crash of the Node.js process, which cannot be caught or handled by the application, effectively denying service. The vulnerability is particularly severe as it can be triggered by a small input, making it easy for attackers to exploit.
How To Fix
Latest published version: 5.0.12 as of 22 Oct 2026
npm install brace-expansion@5.0.12Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0.8
This is the first release that contains the fix.
npm install brace-expansion@5.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, avoid passing untrusted input to the expand() function. You can also set a small explicit max and maxLength to limit the output size. For example:
const { expand } = require('brace-expansion');
const options = { max: 100, maxLength: 4000000 };
try {
const result = expand('{a,b}'.repeat(1500), options);
} catch (e) {
console.error('Error during expansion:', e);
}
Conclusion
The brace-expansion package has a critical vulnerability (CVE-2026-14257) that can lead to denial of service through out-of-memory crashes. It is essential to upgrade to the patched version (5.0.8) to mitigate this risk. Additionally, developers should be cautious when handling untrusted input to prevent exploitation.
See every vulnerability recorded for brace-expansion →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If left unaddressed, this vulnerability can be exploited by attackers to crash your Node.js application, leading to service denial and potential data loss.
Yes, you can limit the input to the expand() function and avoid using untrusted strings to reduce the risk of exploitation.
The out-of-memory error is caused by the unbounded growth of the output size when chaining multiple brace groups, which leads to excessive memory consumption.
References
Related vulnerabilities
Recent vulnerabilities recorded for brace-expansion.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
