fix: patch brace-expansion for CVE-2026-14257 - #5557
Open
danieltprice wants to merge 1 commit into
Open
Conversation
Bump all three transitive installs of brace-expansion to their in-range patched versions, resolving the unbounded-expansion DoS (GHSA-mh99-v99m-4gvg): 1.1.13 -> 1.1.18 (patched in 1.1.17) 2.0.3 -> 2.1.4 (patched in 2.1.3) 5.0.6 -> 5.0.9 (patched in 5.0.8) Done via a lockfile-only `npm update brace-expansion`, so each dependent stays within its declared semver range and no version is frozen by an override. Supersedes #5435, which forced all installs to an exact 2.1.3 via a package.json override (a cross-major downgrade for the 5.x consumer). Co-authored-by: Isaac
danieltprice
requested review from
andrelandgraf,
philip and
ruf-io
as code owners
August 17, 2026 11:50
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Patches all three transitive installs of
brace-expansionto resolve CVE-2026-14257 (GHSA-mh99-v99m-4gvg), a HIGH-severity DoS:expand()limits result count but not result length, so chained brace groups can trigger an uncatchable V8 out-of-memory crash.Changes
Lockfile-only
npm update brace-expansion. Each install moves to the latest version within its dependent's declared semver range:No
package.jsonoverride, so nothing is frozen and each dependent stays within range.Why not #5435
The contributed PR #5435 flags the same CVE but fixes it with
"overrides": { "brace-expansion": "2.1.3" }, which forces all installs to an exact 2.1.3 — a cross-major downgrade for the^5.0.5consumer (markdownlint-cli → minimatch) and a permanent version freeze that blocks future patches. This PR takes the clean per-line approach instead and supersedes it.Risk
Low practical exposure:
brace-expansionis a dev/build-time transitive dep (glob, minimatch, markdownlint-cli), and the DoS requires attacker-controlled brace patterns, which the build doesn't process. Patched anyway for clean scans. All three target versions were published 2026-07-30, past the proxy cooldown.This pull request and its description were written by Isaac.