Summary

The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help.

A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.

Details

maxLength was enforced in combine(), the single place output grows. Two arrays are built before combine() runs, and neither was bounded.

1. Comma alternatives accumulate without a running total (memory exhaustion)

Each alternative in {a,b,c,...} is expanded by its own recursive expand_() call, so each receives a full, independent maxLength allowance. The results were then concatenated into a single values array with no cumulative limit:

values = []
for (let j = 0; j < n.length; j++) {
  values.push.apply(values, expand_(n[j], max, maxLength, false))
}

acc = combine(acc, pre, values, max, maxLength, ...)

With A alternatives, values can reach A * maxLength characters before combine() gets a chance to truncate it. At the default maxLength of 4,000,000 and 400 alternatives, that is well past any default heap.

2. Padded sequences ignore maxLength while generating (CPU exhaustion)

expandSequence() was bounded by max (the result count) but never consulted maxLength. A padded sequence's element width follows the input, so {0...01..100000} with a wide pad generates max elements, each as wide as the input, only for combine() to discard all but a handful.

Memory stays flat here, because V8 represents the padded strings as cons-strings, which is likely why this path was not caught alongside the original issue. The cost is time: work proportional to max * width.

Output is byte-identical before and after the fix; only the wasted work is removed.

Proof of concept

Memory exhaustion, against 5.0.8:

import { expand } from 'brace-expansion'

const part = '{' + '0'.repeat(50) + '1..100000}'
const input = '{' + Array(400).fill(part).join(',') + '}'  // ~25 KB

try {
  expand(input)
} catch (e) {
  // never reached - the process is already dead
}

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
Aborted

Event-loop stall, against 5.0.8:

import { expand } from 'brace-expansion'

// ~400 KB input, returns 9 results after roughly two minutes of blocking CPU
expand('{' + '0'.repeat(400_000) + '1..100000}')

Impact

Denial of service. Any application that passes attacker-controlled input to expand(), directly or transitively through a glob or pattern-matching library, can be remotely crashed or stalled. The out-of-memory variant terminates the process and cannot be handled with try/catch.

Applications already on 5.0.8 are affected: the 5.0.8 mitigation does not cover these paths.

Patches

Both intermediate arrays are now bounded as they are built, using the same max and maxLength limits already applied in combine():

• values tracks a running result count and character length while alternatives are appended, and stops once either bound is reached.
• expandSequence() accepts maxLength and stops generating once the sequence's own characters reach it.

As with the existing limits, output is truncated rather than allowed to grow without bound, which matches how max already behaves. The defaults sit well above any realistic expansion, so legitimate input is unaffected.

Workarounds

If upgrading is not immediately possible, avoid passing untrusted input to expand() or to glob brace patterns, or pass an explicitly small max and maxLength.

Note that a small maxLength alone was not sufficient on affected versions: it was applied per alternative rather than cumulatively, which is the root of the first issue above.

Credits

The memory-exhaustion bypass was reported by Alessio Della Libera, CEO & Co-founder at Numyra.

The sequence-generation issue was found while verifying that report.

Multiple versions of the Node.js minimist module contain a prototype pollution vulnerability in the setKey() function, enabling remote code execution and uncontrolled resource consumption, affecting various products including NetApp and several Node.js updates.

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the minimatch package's braceExpand function, affecting multiple dependent products including Catboost, Dash-extensions, and Jnitrace, which have updated to minimatch version 3.1.2 to address the issue.

Babel versions prior to 7.23.2 and related plugins are vulnerable to arbitrary code execution via the internal methods path.evaluate() and path.evaluateTruthy() when compiling attacker-crafted code.

A vulnerability in the BC-JAVA library's GOST 28147-2015 CTR mode causes keystream reuse after 255 blocks, affecting multiple versions and IBM Db2 Server, enabling attackers to compromise data confidentiality.

A second-order SQL injection vulnerability in Hibernate ORM versions 5.2.8 to 5.6.15, affecting Red Hat and NetApp products, allows remote attackers with low privileges to exploit unsanitized non-alphanumeric characters, risking data disclosure and manipulation.

Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can bypass security controls and lead to cache poisoning, access control bypass, and session hijacking.

A resource allocation vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg before version 1.84 allows unauthenticated attackers to cause memory exhaustion and denial of service via unbounded PGP AEAD chunk sizes.

Multiple lodash vulnerabilities, including CVE-2021-23337 and command injection in _.template, affect various versions and Oracle products, enabling code injection and remote takeover with severity up to CVSS 9.8, fixed in lodash 4.18.0 and later.

fast-uri versions 3.1.0 and earlier improperly decode percent-encoded path separators and dot segments before normalization, causing distinct URIs to collapse into the same path and enabling bypass of path-based security policies.

fast-uri versions up to 3.1.1 improperly decode percent-encoded authority delimiters in the host component, altering URI structure and enabling redirection to unintended hosts.

Eclipse Jetty's DigestAuthentication improperly uses ISO-8859-1 encoding for password hashing, causing non-Latin-1 characters to be replaced with '?', enabling attackers to bypass authentication via hash collisions and impersonation.

The form-data library up to version 4.0.5 is vulnerable to CRLF injection due to unescaped carriage return, line feed, and double-quote characters in multipart field names and filenames, fixed in versions 2.5.6, 3.0.5, and 4.0.6 by escaping these characters.

Multiple Node.js updates address a denial of service vulnerability in the undici WebSocket client caused by unbounded memory growth from numerous small or empty continuation frames, alongside other critical security fixes.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability in CMS AuthEnvelopedData where tag-length enforcement fails during decryption, potentially compromising data integrity.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 contain a vulnerability in KCCMBlockCipher MAC where nonce binding fails without AAD, enabling cross-nonce AEAD forgery attacks.

Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 are vulnerable to IESEngine stream-mode MAC forgery due to a length-dependent key derivation function split issue.

brace-expansion versions through 5.0.6 have a denial of service vulnerability due to the expand() function's exponential-time complexity when processing consecutive non-expanding brace groups, causing high CPU usage and event-loop blocking.

Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where lazy ASN.1 sequence forcing resets the nesting-depth guard, potentially compromising security controls.

fast-uri versions 2.3.1 through 4.0.0 fail to properly canonicalize Unicode/IDN hostnames in HTTP URLs, causing discrepancies with Node's URL parser that can be exploited to bypass host-based security policies.

brace-expansion versions through 5.0.7 contain a denial of service vulnerability due to unbounded string length in the expand() function, leading to memory exhaustion and fixed in version 5.0.8 by adding a maxLength limit.

Bouncy Castle for Java versions prior to 1.85, including certain LTS, FIPS, and bctls-fips versions, contains a vulnerability that can cause out-of-memory errors due to unbounded memory allocation during definite-length reads.

fast-uri versions 2.3.1 to 4.1.0 improperly handle backslashes in URLs, causing host parsing inconsistencies with Node's WHATWG URL parser that can lead to security bypasses, requiring upgrades to fixed versions.

fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4 improperly parse URIs with backslashes instead of double forward slashes, causing discrepancies with Node's WHATWG URL parser and enabling host-based security policy bypasses.

A critical Broken Authentication & Session Management vulnerability (CVE-2026-21582) in Atlassian Crowd Data Center 7.2.1 enables unauthenticated attackers to impersonate other users.

Multiple Apache Tomcat and Apache Tomcat Native versions contain an improper input validation vulnerability in OCSP response handling that allows bypassing certificate revocation checks, with additional critical flaws affecting related products like Oracle Siebel CRM and SAP Commerce Cloud.

Multiple vulnerabilities in axios versions prior to 0.30.3 and 1.13.5 cause denial of service via mergeConfig crashing on configuration objects containing __proto__, alongside various security issues in HPE and Oracle products.

Underscore.js versions up to 1.13.7 and Oracle Commerce Platform 11.4.0 contain vulnerabilities causing denial of service via stack overflow or application hang through recursive data processing or business control center flaws, while HPE UOCAM suffers from multiple security issues including path traversal and resource overconsumption.

Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a high-severity arbitrary file write vulnerability via path traversal due to improper filename sanitization, enabling attackers to overwrite files and potentially execute remote code.

Node-tar versions prior to 7.5.10 contain a vulnerability allowing crafted archives to create hardlinks with drive-relative link targets on Windows, enabling path traversal and file overwrite outside the extraction directory.

Micrometer versions 1.15.0 to 1.15.11 and 1.16.0 to 1.16.5 contain a vulnerability where specially crafted gRPC requests can trigger a denial-of-service (DoS) condition, impacting system availability.

Micrometer versions 1.9.0 through 1.16.5, including micrometer-core and micrometer-jetty, are vulnerable to specially crafted HTTP requests that can cause a denial-of-service (DoS) condition, impacting system availability.

Apache Tomcat versions 9.0.0.M1 to 11.0.21 have multiple vulnerabilities including unbounded WebDAV request bodies, HTTP/2 header validation flaws, WebSocket authentication exposure, and authorization bypass, leading to denial of service, crashes, and credential exposure.

Spring Framework versions used in Spring MVC and WebFlux applications are vulnerable to DoS attacks during static resource resolution, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a remotely exploitable vulnerability allowing system takeover, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications products, including a JavaScript escaping flaw enabling XSS, a difficult-to-exploit remote takeover in BRM Elastic Charging Engine, and a non-exploitable security-in-depth issue in Management Cloud Engine.

Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0, including an Algorithmic DoS and a difficult-to-exploit remote takeover vulnerability.

Certain Spring Framework versions are vulnerable to DoS via unbounded cache growth from user-supplied SpEL expressions, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a difficult-to-exploit unauthenticated HTTP takeover vulnerability, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.

The uuid library versions prior to 14.0.0 have a vulnerability in v3, v5, and v6 UUID functions where missing buffer bounds checks allow silent partial or out-of-range writes to caller-provided buffers, potentially causing malformed UUIDs.

Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution attacks that enable attackers to intercept, modify JSON responses, or hijack HTTP requests and responses via polluted configuration properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests by exploiting polluted Object.prototype properties.

Axios versions prior to 1.15.1 and 0.31.1 contain a high-severity Prototype Pollution vulnerability in the validateStatus property merge strategy that allows attackers to bypass authentication and error handling by treating all HTTP error responses as successful.

pgjdbc versions 42.2.0 to before 42.7.11 are vulnerable to client-side denial of service via excessive CPU usage during SCRAM-SHA-256 authentication, fixed in 42.7.11, while Oracle Communications Cloud Native Core Console versions 25.1.203 and 25.2.201 have a network-accessible SQL injection denial of service vulnerability.

Multiple vulnerabilities in Apache Netty prior to versions 4.1.133.Final and 4.2.13.Final allow remote attackers to cause excessive memory allocation, denial of service, and potential data compromise via crafted LZ4 compressed data and HTTP/2 requests.

Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstandard, and Snappy encodings, causing out-of-memory denial of service.

Apache Tomcat versions 7.0.0 to 11.0.21 contain multiple security vulnerabilities including LockOutRealm case sensitivity issues, digest authentication bypass, WebDAV request size DoS, HTTP/2 header validation flaws, WebSocket authentication exposure, and AJP secret comparison weaknesses.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain an IPv6 subnet bypass vulnerability in IpSubnetFilterRule.compareTo() due to incorrect masking, allowing unauthorized access control bypass.

Axios Node.js HTTP adapter versions prior to 0.32.0 and 1.16.0 can leak proxy credentials via stale Proxy-Authorization headers when following redirects from proxied to non-proxied targets, exposing sensitive authentication data.

Axios versions prior to 0.32.0 and 1.16.0 have a vulnerability in the Node.js HTTP adapter where Proxy-Authorization headers may be forwarded to redirected origins during proxy-to-direct redirect flows, risking exposure of sensitive proxy credentials.

Axios versions 1.7.0 through 1.15.x failed to enforce configured request and response size limits when using the fetch adapter, allowing oversized bodies that can cause resource exhaustion in server-side applications.

Axios versions prior to 1.16.0, including 1.15.2 and earlier, are vulnerable to prototype pollution that enables arbitrary HTTP header injection, sensitive data leakage, and denial-of-service crashes due to unsafe merging of object properties.

Axios versions prior to 0.32.0 and 1.16.0 contain a vulnerability where IPv4-mapped IPv6 addresses are not normalized in the shouldBypassProxy function, allowing NO_PROXY restrictions to be bypassed and requests to be routed through proxies improperly.

Axios versions 1.0.0 to before 1.16.0 contain a Prototype Pollution gadget in `config.proxy` that escalates Object.prototype pollution into a full Man-in-the-Middle attack, enabling interception and modification of all HTTP traffic including credentials.

Axios versions prior to 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request config processing that can be exploited via a polluted Object.prototype.transformResponse from another vulnerability, enabling credential theft, response hijacking, or denial-of-service.

Axios versions before 0.32.0 and 1.16.0 have a vulnerability where unescaped regex metacharacters in the XSRF cookie name cause excessive regex backtracking, leading to client-side denial of service by freezing the browser tab.

Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a critical vulnerability in SslClientHelloHandler.decode() that causes unbounded memory allocation from crafted TLS ClientHello messages, leading to potential denial of service.

PostCSS versions up to 8.5.11 contain a vulnerability where attacker-controlled sourceMappingURL comments in CSS enable arbitrary local file reads, partial content disclosure, file-existence oracle, and potential denial of service.

The js-cookie library's assign() function was vulnerable to prototype pollution via JSON objects containing a __proto__ property, allowing attackers to manipulate cookie attributes such as domain, secure, and samesite.