« Volver al listado

CVE-2026-14257

Estado: AnalizadaAlta (7.5)—

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process.

Leer descripción completaMostrar menos

Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS de red sin autenticación (AV:N/PR:N/UI:N) con impacto de disponibilidad (A:H). Aplicación expuesta en red que se cuelga por exhaustión de memoria con entrada pequeña.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Juliangruber — Brace-expansion

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-14257",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-14257",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-23T14:44:31.208878Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
      "affectedData": [
        {
          "vendor": "juliangruber",
          "product": "brace-expansion",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "5.0.7"
            }
          ],
          "platforms": [
            "Linux",
            "macOS",
            "Windows"
          ],
          "packageName": "brace-expansion",
          "collectionURL": "https://www.npmjs.com/package/brace-expansion",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-23T14:17:00.250",
  "references": [
    {
      "url": "https://github.com/juliangruber/brace-expansion",
      "tags": [
        "Product"
      ],
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
    },
    {
      "url": "https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5",
      "tags": [
        "Patch"
      ],
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
    },
    {
      "url": "https://www.npmjs.com/package/brace-expansion",
      "tags": [
        "Product"
      ],
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "22e2d327-25fe-45d7-9f0c-dcd23b7108df",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays."
    }
  ],
  "lastModified": "2026-08-27T18:52:15.293",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A3C9190-9761-4391-A6B5-9C56EFDDB63C",
              "versionEndExcluding": "1.1.17"
            },
            {
              "criteria": "cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7CB6D5D-C7B5-4E8B-8204-55A9E5D923A9",
              "versionEndExcluding": "2.1.3",
              "versionStartIncluding": "2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CC7869F-C0AA-4AB5-9F7D-F0A640ACADEC",
              "versionEndExcluding": "3.0.3",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BEEAFEA-44B5-4B1B-A25A-2224F3C9F94C",
              "versionEndExcluding": "5.0.8",
              "versionStartIncluding": "4.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "22e2d327-25fe-45d7-9f0c-dcd23b7108df"
}