Debian/node-brace-expansion: high 7.5
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the le
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: DEBIAN-CVE-2026-14257#Debian:14/node-brace-expansion
- https://security-tracker.debian.org/tracker/CVE-2026-14257
published · modified · JSON