Security vulnerabilities and automated fixes for brace expansion issues
6 posts found
A critical denial-of-service vulnerability in the `brace-expansion` package allowed attackers to exhaust process memory through unbounded intermediate array expansion. The fix upgrades the package to patched versions (1.1.18, 2.1.4, 3.0.6, 5.0.9) that implement proper expansion length limits, preventing out-of-memory crashes in production applications.
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package caused by exponential-time processing of specially crafted brace patterns. The vulnerability was discovered in `cdk-eregs/package-lock.json` and fixed by upgrading to patched versions (1.1.16, 2.1.2, and 5.0.7+) via an npm `overrides` directive. Left unpatched, an attacker who can influence brace-pattern inputs could freeze or crash Node.js processes with a surprisingly small malicious string.
CVE-2026-69152 exposed a critical Denial of Service vulnerability in the brace-expansion library that bypassed the previous CVE-2026-14257 mitigation through unbounded intermediate arrays. This vulnerability affected multiple versions of brace-expansion used throughout the dependency tree via minimatch, requiring coordinated upgrades across four major version lines (1.1.18, 2.1.4, 3.0.6, and 5.0.9) to eliminate the attack surface.
CVE-2026-14257 is a denial-of-service vulnerability in the brace-expansion library that allows attackers to crash applications through unbounded expansion of brace patterns. By upgrading from version 2.1.2 to 2.1.3 and 5.0.6 to 5.0.8, we eliminated the risk of memory exhaustion attacks targeting glob pattern expansion in build tools and scripts.
CVE-2026-13149 is a denial of service vulnerability in the brace-expansion library that allows attackers to craft specially-formatted input strings that trigger exponential-time complexity in the expansion algorithm. This fix upgrades brace-expansion from version 1.1.15 to 1.1.16, eliminating the algorithmic flaw that could freeze applications processing untrusted input patterns.