The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-12.4-develUpgrade nodejs-libsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-develUpgrade v8-13.6-develUpgrade nodejs-docsUpgrade nodejs | Oct 11, 2026 | Aug 12, 2026 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Sep 16, 2026 | Sep 15, 2026 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs24-npmUpgrade nodejs-full-i18nUpgrade nodejs24-develUpgrade v8-13.6-develUpgrade nodejs24-libsUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs24-docsUpgrade nodejs-packaging-bundlerUpgrade nodejs24Upgrade v8-12.4-develUpgrade nodejs-npmUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade npmUpgrade nodejs24-full-i18n | Oct 22, 2026 | Aug 3, 2026 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 23, 2026 | Aug 3, 2026 |
| Redhat_linux | — | Upgrade eap8-neethiUpgrade eap8-jackson-annotationsUpgrade eap8-wildfly-javadocsUpgrade v8-13.6-develUpgrade eap8-activemq-artemis-core-clientUpgrade npmUpgrade eap8-bouncycastle-provUpgrade eap8-netty-transportUpgrade eap8-bouncycastle-pkixUpgrade nodejs-npmUpgrade eap8-netty-transport-native-epoll-debuginfoUpgrade eap8-apache-cxf-toolsUpgrade eap8-activemq-artemis-dtoUpgrade eap8-activemq-artemis-jakarta-service-extensionsUpgrade eap8-activemq-artemis-jakarta-clientUpgrade eap8-slf4j-apiUpgrade nodejs24-libs-debuginfoUpgrade nodejs-debuginfoUpgrade eap8-jbossws-common-toolsUpgrade eap8-jackson-datatype-jsr310Upgrade v8-12.4-develUpgrade eap8-hibernate-enversUpgrade eap8-ironjacamar-common-apiUpgrade eap8-ironjacamarUpgrade eap8-eap-product-conf-wildfly-ee-feature-packUpgrade eap8-netty-codecUpgrade eap8-netty-codec-httpUpgrade eap8-jaxb-xjcUpgrade eap8-jboss-loggingUpgrade nodejs24-debugsourceUpgrade eap8-log4jUpgrade eap8-jaxb-jxcUpgrade eap8-jaxbUpgrade eap8-eap-product-conf-parentUpgrade eap8-ironjacamar-common-implUpgrade nodejs24-docsUpgrade eap8-undertowUpgrade eap8-relaxng-datatypeUpgrade eap8-jbossws-jaxws-undertow-httpspiUpgrade eap8-artemis-wildfly-integrationUpgrade nodejs-debugsourceUpgrade eap8-netty-transport-native-unix-commonUpgrade eap8-nettyUpgrade eap8-ironjacamar-core-implUpgrade eap8-jbossws-cxfUpgrade eap8-activemq-artemis-hornetq-protocolUpgrade nodejs24-debuginfoUpgrade nodejs-nodemonUpgrade eap8-netty-codec-dnsUpgrade eap8-txw2Upgrade eap8-bouncycastle-utilUpgrade nodejs22-debuginfoUpgrade eap8-hibernateUpgrade eap8-jackson-dataformats-textUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade eap8-ironjacamar-deployers-commonUpgrade eap8-activemq-artemis-jakarta-raUpgrade eap8-activemq-artemis-journalUpgrade eap8-jbossws-spiUpgrade eap8-jackson-jaxrs-baseUpgrade eap8-activemq-artemis-jakarta-serverUpgrade eap8-jaxb-coreUpgrade eap8-jaxbintrosUpgrade eap8-netty-resolver-dnsUpgrade eap8-activemq-artemis-jdbc-storeUpgrade eap8-jackson-modules-java8Upgrade eap8-jackson-databindUpgrade nodejs24Upgrade eap8-httpcomponents-asyncclientUpgrade eap8-bouncycastleUpgrade eap8-netty-commonUpgrade nodejs-develUpgrade eap8-activemq-artemis-serverUpgrade eap8-activemq-artemis-hqclient-protocolUpgrade eap8-netty-handlerUpgrade eap8-wildfly-elytron-toolUpgrade eap8-apache-cxfUpgrade rh-podman-desktopUpgrade eap8-jackson-datatype-jdk8Upgrade nodejs22-debugsourceUpgrade eap8-activemq-artemis-cliUpgrade eap8-ironjacamar-validatorUpgrade eap8-netty-transport-classes-epollUpgrade eap8-netty-codec-socksUpgrade eap8-activemq-artemisUpgrade eap8-netty-handler-proxyUpgrade eap8-jackson-modules-baseUpgrade eap8-jboss-remotingUpgrade eap8-jackson-module-jakarta-xmlbind-annotationsUpgrade eap8-slf4jUpgrade nodejs24-npmUpgrade eap8-apache-cxf-rtUpgrade eap8-bouncycastle-jmailUpgrade eap8-wildfly-elytronUpgrade eap8-apache-cxf-servicesUpgrade nodejsUpgrade eap8-hibernate-coreUpgrade nodejs-libsUpgrade nodejs24-libsNo solution existsUpgrade nodejs24-develUpgrade eap8-wildfly-modulesUpgrade nodejs-packagingUpgrade eap8-activemq-artemis-selectorUpgrade eap8-xsomUpgrade eap8-codemodelUpgrade eap8-jakarta-xml-bind-apiUpgrade eap8-nimbus-jose-jwtUpgrade eap8-ironjacamar-core-apiUpgrade eap8-jackson-jaxrs-json-providerUpgrade eap8-jsf-implUpgrade eap8-parssonUpgrade eap8-wildflyUpgrade eap8-ws-commons-XmlSchemaUpgrade eap8-jbossws-apiUpgrade eap8-jackson-coreUpgrade eap8-wildfly-java-jdk21Upgrade eap8-netty-resolverUpgrade eap8-rngomUpgrade eap8-ironjacamar-jdbcUpgrade nodejs-packaging-bundlerUpgrade eap8-netty-transport-native-epollUpgrade nodejs24-full-i18nUpgrade nodejs-libs-debuginfoUpgrade eap8-activemq-artemis-commonsUpgrade eap8-netty-bufferUpgrade eap8-bouncycastle-pgUpgrade eap8-cryptacularUpgrade eap8-jackson-dataformat-yamlUpgrade eap8-xml-securityUpgrade eap8-ironjacamar-common-spiUpgrade eap8-jaxb-runtimeUpgrade eap8-saaj-impl | Aug 5, 2026 | Aug 3, 2026 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade nodejs-debugsourceUpgrade v8-12.4-develUpgrade nodejs-debuginfoUpgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade v8-13.6-develUpgrade nodejs-develUpgrade npmUpgrade nodejs | Aug 20, 2026 | Aug 18, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub