Security vulnerabilities and automated fixes for cve 2026 14257 issues
4 posts found
A high-severity denial-of-service vulnerability (CVE-2026-14257) was discovered in the `brace-expansion` npm package through version 5.0.7, affecting projects that transitively depend on it via tools like `@sentry/bundler-plugin-core` and `@typescript-eslint/typescript-estree`. The fix removes pinned vulnerable copies of `brace-expansion@2.1.2` nested inside `minimatch` sub-dependencies and allows the dependency tree to resolve to patched versions (5.0.8, 3.0.3, 2.1.3, or 1.1.17). Left unpatched
A high-severity Denial of Service vulnerability (CVE-2026-14257) in the `brace-expansion` package version 1.1.12 allowed attackers to craft malicious brace patterns that caused exponential-time complexity, leading to out-of-memory process crashes. The fix upgrades the dependency to version 1.1.16 using npm overrides to ensure the patched version is used throughout the entire dependency tree.
CVE-2026-14257 is a denial-of-service vulnerability in the brace-expansion library that allows attackers to crash applications through unbounded expansion of brace patterns. By upgrading from version 2.1.2 to 2.1.3 and 5.0.6 to 5.0.8, we eliminated the risk of memory exhaustion attacks targeting glob pattern expansion in build tools and scripts.
CVE-2026-14257 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings could trigger unbounded memory expansion, crashing the Node.js process. The fix upgrades `brace-expansion` from version `1.1.16` to `5.0.8` in the UI application's lock file, eliminating the uncapped expansion behavior. This change protects production services from availability attacks that could be triggered by user-influenced input flowing through glob or path-mat