CyberRota Analysis
AI-GeneratedThe brace-expansion library is vulnerable to a denial-of-service attack due to improper handling of user input in the expand() function, which can lead to memory exhaustion or event loop blockage. This issue affects versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, and it also bypasses the fix for a related vulnerability (CVE-2026-14257). Organizations using affected versions should prioritize updating to the patched releases to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
Related CVEs
Other vulnerabilities affecting the same vendor(s)