Allocation of Resources Without Limits or Throttling in brace-expansion - CVE-2026-14257

Vulnerability identifier: #VU140706

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-14257

CWE-ID: CWE-770

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in expand() when processing attacker-influenced brace expansion patterns. A remote attacker can send a specially crafted input string to cause a denial of service.

The issue can terminate the Node process with an uncatchable out-of-memory error.

brace-expansion
Platform Navigator in IBM Cloud Pak for Integration (CP4I)
IBM Security QRadar Network Threat Analytics
Netezza Appliance - Cyclops
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Bitbucket Data Center
Jira Service Management Data Center
Jira Software Data Center
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems
nodejs-nodemon (Red Hat package)
nodejs22 (Red Hat package)
Informix Dynamic Server

Install security update from vendor's website.

brace-expansion - addressed in versions 1.1.17, 2.1.3, 3.0.3, 5.0.8
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.25-sc2, 4.4.2
Bitbucket Data Center - addressed in versions 9.4.23, 10.2.6, 10.4.2
Jira Service Management Data Center - addressed in versions 10.3.25, 11.3.10
Jira Software Data Center - addressed in versions 10.3.25, 11.3.11
Platform Navigator in IBM Cloud Pak for Integration (CP4I) - addressed in versions 16.1.0.28, 16.2.0.3
IBM Security QRadar Network Threat Analytics - update to 2.0.2
nodejs-nodemon (Red Hat package) - update to 3.1.14-3.el10_0
Netezza Appliance - Cyclops - update to 11.3.1.4
Informix Dynamic Server - addressed in versions 14.10.FC14W1, 15.0.1.16
nodejs22 (Red Hat package) - update to 22.23.1-6.el10_2

• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg

• Allocation of Resources Without Limits or Throttling in brace-expansion
• Red Hat Enterprise Linux 10 update for nodejs-nodemon
• Red Hat Enterprise Linux 10 update for nodejs22
• Multiple vulnerabilities in Bitbucket Data Center
• Multiple vulnerabilities in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration
• Multiple vulnerabilities in IBM Netezza Appliance - Cyclops
• Multiple vulnerabilities in IBM Informix Dynamic Server
• Multiple vulnerabilities in Jira Service Management Data Center
• Multiple vulnerabilities in Jira Software Data Center
• Multiple vulnerabilities in Network Threat Analytics App for IBM QRadar SIEM