CVE-2026-14257: 
JavaScript vulnerability analysis and mitigation

CVE-2026-14257 is a Denial of Service vulnerability in the brace-expansion npm package (versions ≤ 5.0.7) caused by unbounded expansion output length leading to memory exhaustion. The expand() function caps the number of results via a max option (default 100,000) but places no limit on the length of each result string, allowing an attacker to craft input that keeps result count under the limit while growing each result arbitrarily long. Approximately 7.5 KB of input ('{a,b}'.repeat(1500)) is sufficient to crash a default Node.js process with a fatal, uncatchable out-of-memory error. It was published on July 23, 2026, with a patch released the same day. The CVSS v3.1 base score is 7.5 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The expand_() function recursively combines brace groups, materializing intermediate arrays of up to max strings at each recursion level; because V8 represents string concatenations as cons-strings (ropes) that reference prior results, all intermediate arrays remain reachable throughout the call chain, causing memory to scale as max × N where N is the number of chained brace groups. An attacker exploits this by sending a small HTTP request containing a crafted brace-expansion pattern (e.g., '{a,b}'.repeat(1500)) to any application that passes user-controlled input to brace-expansion.expand() — directly or transitively through minimatch or glob. No authentication or special privileges are required, and the resulting OOM error cannot be caught with try/catch, making recovery impossible without process restart (Github Advisory, Patch Commit).

Successful exploitation causes a fatal, uncatchable V8 out-of-memory crash that terminates the entire Node.js worker or process, resulting in complete service unavailability. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Any application that transitively uses brace-expansion through popular packages such as minimatch or glob is potentially affected, significantly broadening the attack surface across the npm ecosystem (Github Advisory, Feedly).

1. Reconnaissance: Identify applications that accept user-controlled string input and pass it to brace-expansion.expand() directly or via minimatch/glob (e.g., file search endpoints, glob-based routing, or CLI tools exposed over a network).
2. Craft malicious payload: Construct a brace-expansion string that chains many brace groups while keeping the result count under the max limit. The minimal crash payload is '{a,b}'.repeat(1500) (~7.5 KB), which produces 100,000 results each ~1,500 characters long.
3. Deliver payload: Send the crafted string as input to the target application — for example, as a query parameter, request body field, or filename pattern — in a single HTTP request.
4. Trigger OOM crash: The expand() call builds intermediate arrays whose combined size exhausts the Node.js heap, causing a fatal FATAL ERROR: JavaScript heap out of memory that terminates the process. Because the error is uncatchable, no error handler or try/catch block can prevent the crash, resulting in immediate denial of service (Github Advisory).

• Logs: Node.js process logs containing FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory or similar V8 OOM messages immediately following receipt of a request.
• Logs: Application or web server access logs showing a single small request (~7–8 KB body or query string) containing repeated brace patterns (e.g., {a,b} repeated many times) shortly before a process crash.
• Process: Unexpected, sudden termination of the Node.js process (exit code indicating OOM) without a preceding caught exception or graceful shutdown signal.
• Network: Repeated small HTTP requests to endpoints that perform glob or brace-expansion processing, potentially indicating probing or repeated crash attempts by an attacker (Github Advisory).

Upgrade brace-expansion to version 5.0.8 or later, which introduces a maxLength option (default 4,000,000 characters) that bounds total accumulated output and intermediate arrays, preventing memory exhaustion (Github Advisory, Patch Commit). If immediate patching is not possible, implement input validation and enforce size limits on any strings passed to expand() before they reach the library, and avoid passing untrusted input to minimatch or glob brace patterns. Passing an explicit small max and maxLength value when calling expand() directly also mitigates the issue on unpatched versions. Red Hat has issued an errata (RHSA-2026:45360) for affected products (Red Hat Errata).

Red Hat issued security errata RHSA-2026:45360 addressing this vulnerability in affected Red Hat products (Red Hat Errata). The vulnerability was credited to researcher bnbdr as the finder, per the GitHub Advisory (Github Advisory). No significant broader community or social media discussion has been identified beyond standard vulnerability tracking and aggregation sites.