Spotted what might be an issue in package-lock.json around line 75.
The project depends on brace‑expansion version 1.1.15, which is affected by CVE‑2026‑14257. The library’s expand() function only limits the number of generated results, not the length of each result string. An attacker can supply a pattern with many nested brace groups that stays under the default result‑count limit while producing extremely long strings, causing the Node.js process to exhaust memory and crash (denial‑of‑service). Because brace‑expansion is used directly and indirectly (e.g., via minimatch or glob), any user‑controlled input that reaches expand() can trigger the crash. This is rated HIGH severity due to the ease of exploitation and the impact of a complete service outage.
Something like this might fix it:
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@
- "brace-expansion": "1.1.15",
+ "brace-expansion": "5.0.8",
\n# After updating the version, regenerate the lock file and reinstall:
# npm install brace-expansion@5.0.8 --save-exact
# npm audit fix --force # if other vulnerable transitive deps exist
# This upgrades to a version that includes the `maxLength` option (default 4,000,000) and prevents the memory‑exhaustion attack.
For reference: rule CVE-2026-14257. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
package-lock.jsonaround line 75.The project depends on brace‑expansion version 1.1.15, which is affected by CVE‑2026‑14257. The library’s expand() function only limits the number of generated results, not the length of each result string. An attacker can supply a pattern with many nested brace groups that stays under the default result‑count limit while producing extremely long strings, causing the Node.js process to exhaust memory and crash (denial‑of‑service). Because brace‑expansion is used directly and indirectly (e.g., via minimatch or glob), any user‑controlled input that reaches expand() can trigger the crash. This is rated HIGH severity due to the ease of exploitation and the impact of a complete service outage.
Something like this might fix it:
For reference: rule
CVE-2026-14257. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.