{"action":"Upgrade brace-expansion to 1.1.17 or later.","affected":[{"fixed":"5.0.8","introduced":"4.0.0"},{"fixed":"3.0.3","introduced":"3.0.0"},{"fixed":"2.1.3","introduced":"2.0.0"},{"fixed":"1.1.17","introduced":"0"}],"component":"brace-expansion","cve_ids":["CVE-2026-14257"],"ecosystem":"npm","epss":0.00643,"exploited":false,"fixed_versions":["5.0.8","3.0.3","2.1.3","1.1.17"],"ghsa_id":"GHSA-mh99-v99m-4gvg","id":"tcs_01M5KG0SBCQH84SK91NA1DG82V","modified_at":"2026-09-10T03:50:12.282849322Z","published_at":"2026-07-24T21:53:14Z","references":["https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg","https://nvd.nist.gov/vuln/detail/CVE-2026-14257","https://github.com/juliangruber/brace-expansion/pull/129","https://github.com/juliangruber/brace-expansion/pull/130","https://github.com/juliangruber/brace-expansion/pull/136","https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d","https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5","https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031","https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb","https://github.com/juliangruber/brace-expansion","https://www.npmjs.com/package/brace-expansion"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-mh99-v99m-4gvg","url":"https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg"}],"summary":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash"}