Unleash / unleash / 30837255140

87%

master: 91%

push

github

chore(deps): update dependency brace-expansion@^5.0.0 to v5.0.9 [security] (#12507)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[brace-expansion@^5.0.0](https://redirect.github.com/juliangruber/brace-expansion)
| [`5.0.8` →
`5.0.9`](https://renovatebot.com/diffs/npm/brace-expansion@^5.0.0/5.0.8/5.0.9)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/brace-expansion/5.0.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/brace-expansion/5.0.8/5.0.9?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### brace-expansion: DoS via unbounded expansion length causing an
out-of-memory process crash
[CVE-2026-14257](https://nvd.nist.gov/vuln/detail/CVE-2026-14257) /
[GHSA-mh99-v99m-4gvg](https://redirect.github.com/advisories/GHSA-mh99-v99m-4gvg)

<details>
<summary>More information</summary>

#### Details
##### Summary

`expand()` bounds the *number* of results it produces (the `max` option,
`100_000` by default) but not their *length*. By chaining many brace
groups,
an attacker keeps the result count under `max` while making every result
grow
with the number of groups. Building `max` long results — plus the
intermediate
arrays combined at each brace group — exhausts memory and crashes the
Node
process with an **uncatchable** out-of-memory error. `try/catch` around
`expand()` does not help: the fatal error terminates the process.

A ~7.5 KB input (`'{a,b}'.repeat(1500)`) is enough to crash a default
Node
process.

##### Details

For `N` chained brace groups such as `'{a,b}'.repeat(N)`:

- the result count is `2^N`, immediately capped at `max` (`100_000`), so
the
  `max` protection appears to hold, but
- each result is `N` characters long, so the total output size is... (continued)

1981 of 2191 branches covered (90.42%)

15769 of 18068 relevant lines covered (87.28%)

836.86 hits per line