security: bump brace-expansion for GHSA-mh99-v99m-4gvg - #467
Merged
Conversation
Lockfile-only bump of the transitive brace-expansion dependency to clear GHSA-mh99-v99m-4gvg (CVE-2026-14257, High): unbounded expansion length causes an uncatchable OOM crash. Targets 1.1.18 / 2.1.4 / 5.0.9, which also clear the sibling brace-expansion advisories open at the same time. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01A7XtZXJWpdNvW49CcERj8b
lnaia
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the transitive
brace-expansiondependency out of the range flagged byGHSA-mh99-v99m-4gvg (CVE-2026-14257, High).
expand()caps how many results it produces but not how long they get, so afew KB of chained brace groups is enough to exhaust memory and kill the Node
process. The OOM is fatal, so wrapping the call in
try/catchdoes not help.Anything that feeds attacker-influenced strings into brace patterns through
minimatchorglobcan be crashed this way.Lockfile only.
brace-expansionis not a direct dependency here, andminimatch(the only consumer) declares a caret range that the new versionalready satisfies, so no manifest needed changing.
The versions here are 1.1.18 / 2.1.4 / 5.0.9, not the 1.1.17 / 2.1.3 / 5.0.8
this advisory names. The higher set clears the other brace-expansion advisories
that are open at the same time, and the dependency set is unchanged within each
major line either way.
Worth knowing if you are still on Node 18: brace-expansion raised its engines
floor to
20 || >=22in 5.0.8, so any fix in the 5.x line brings that with it.It warns rather than fails unless you run engine-strict.
To check nothing else moved, I stripped every brace-expansion entry out of the
old and new lockfiles and confirmed the remainder was byte-identical, then ran a
frozen-lockfile install to verify the integrity hashes against the registry.