The brace‑expansion library, used to construct strings that share a common prefix and suffix, fails to enforce a maximum length limit while building comma‑alternative intermediate arrays or padded sequences in pre‑1.1.18, pre‑2.1.4, pre‑3.0.6, and pre‑5.0.9 releases. This omission allows an attacker to provide crafted input that expands into arbitrarily large intermediate arrays, potentially exhausting memory or blocking the JavaScript event loop and resulting in a denial‑of‑service condition. The vulnerability also bypasses the mitigation that addressed CVE‑2026‑14257, meaning systems that relied on that protection remain vulnerable.

brace‑expansion library by juliangruber, versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

The CVSS score of 7.5 indicates a high‑severity vulnerability. The EPSS score of <1% suggests a low probability of exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog, implying no widespread attacks reported yet. Based on the description, it is inferred that an attacker could supply malicious input through any interface that triggers brace expansion, whether the input is provided locally by code or received over a network. By doing so, the attacker could consume excessive memory or block the event loop, leading to service disruption. The bypass of the prior CVE‑2026‑14257 mitigation removes an additional defense layer, increasing exploitable attack surface.