[GHSA-mh99-v99m-4gvg] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

[RMaksymczuk]

Updates

• Affected products

Comments
The Patched versions field lists only 5.0.8, but the fix has since shipped to
the v1, v2, and v3 maintenance branches as 1.1.17, 2.1.3, and 3.0.5. Because the
affected range is still a single bound (<= 5.0.7, fixed 5.0.8), those three
backported-and-patched releases are all still flagged as vulnerable.

Requesting the single range be split per maintenance branch:

• npm brace-expansion affected < 1.1.17 fixed 1.1.17
• npm brace-expansion affected >= 2.0.0, < 2.1.3 fixed 2.1.3
• npm brace-expansion affected >= 3.0.0, < 3.0.5 fixed 3.0.5
• npm brace-expansion affected >= 4.0.0, <= 5.0.7 fixed 5.0.8 (unchanged)

Evidence (release commits each version was published from):
v1.1.17: juliangruber/brace-expansion@5c57cc2
v2.1.3: juliangruber/brace-expansion@878df39
v3.0.5: juliangruber/brace-expansion@813328d
v5.0.8: juliangruber/brace-expansion@96a63c0

Release tags:
https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.17
https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.3
https://github.com/juliangruber/brace-expansion/releases/tag/v3.0.5

Backport PRs:
v1: juliangruber/brace-expansion#130
juliangruber/brace-expansion#129
v3: juliangruber/brace-expansion#136

Advisory: GHSA-mh99-v99m-4gvg / CVE-2026-14257

[github]

Hi there @juliangruber! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[G-Rath]

This update is incorrect as the backport was landed in v3.0.3 - the correct update to the advisory is handled by #8832