Security vulnerabilities and automated fixes for cve 2026 14257 issues
2 posts found
A high-severity denial-of-service vulnerability (CVE-2026-14257) was discovered in the `brace-expansion` npm package through version 5.0.7, affecting projects that transitively depend on it via tools like `@sentry/bundler-plugin-core` and `@typescript-eslint/typescript-estree`. The fix removes pinned vulnerable copies of `brace-expansion@2.1.2` nested inside `minimatch` sub-dependencies and allows the dependency tree to resolve to patched versions (5.0.8, 3.0.3, 2.1.3, or 1.1.17). Left unpatched
CVE-2026-14257 is a denial-of-service vulnerability in the brace-expansion library that allows attackers to crash applications through unbounded expansion of brace patterns. By upgrading from version 2.1.2 to 2.1.3 and 5.0.6 to 5.0.8, we eliminated the risk of memory exhaustion attacks targeting glob pattern expansion in build tools and scripts.