brace-expansion DoS Bypass GHSA-mh99-v99m-4gyv: Unbounded Arrays and Memory Exhaustion

Vulnerability Overview Title: DoS via unbounded intermediate arrays, bypassing the GHSA-mh99-v99m-4gyv mitigation Description: Summary: The fix for added in version 5.0.8 for GHSA-mh99-v99m-4gyv / CVE-2026-14257 is incomplete. It limits the accumulator during result merging but does not limit intermediate arrays, which still cause Node processes to crash due to uncatchable out-of-memory errors in the call. Details: 1. Alternations accumulate without a running total (Memory Exhaustion): Each alternative within is expanded via recursive calls, where each call receives a full, independent allowance. The results are concatenated into a single array without any cumulative limit. 2. Generated sequences ignore (CPU Exhaustion): is constrained by (result count) but never consults . The width of the generated sequence elements follows the input, such as , using wide elements, each as wide as the input. Only discards all but one element. Impact: Any application passing attacker-controlled input to , directly or indirectly via glob or pattern matching libraries, can be remotely crashed or hung. The memory-exhaustion variant terminates the process, which cannot be handled via . Versions 5.0.8 are affected; the fix in 5.0.8 does not cover these paths. Affected Versions Affected Versions: Fixed Versions: Remediation Patch: - Intermediate arrays are now constrained during construction using the same and limits applied in . - tracks running result count and character length when alternatives are appended, stopping when either limit is reached. - accepts and stops generating when the sequence's own character count is reached. - As with existing limits, output is truncated rather than allowed to grow unboundedly, consistent with the behavior of . - Default values and any reasonable expansions with legitimate input remain unaffected. Workaround: - If an immediate upgrade is not possible, avoid passing untrusted input to , or glob brace patterns, or pass an explicitly small and . - Note: A small alone is insufficient on affected versions; it is applied per alternative rather than cumulatively, which is the root cause of the first issue. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

brace-expansion DoS Bypass GHSA-mh99-v99m-4gyv: Unbounded Arrays and Memory Exhaustion

More from this source