Skip to content

[GHSA-mh99-v99m-4gvg] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - #8916

Closed
thedavidthomas wants to merge 1 commit into
thedavidthomas/advisory-improvement-8916from
thedavidthomas-GHSA-mh99-v99m-4gvg
Closed

[GHSA-mh99-v99m-4gvg] brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash#8916
thedavidthomas wants to merge 1 commit into
thedavidthomas/advisory-improvement-8916from
thedavidthomas-GHSA-mh99-v99m-4gvg

Conversation

@thedavidthomas

Copy link
Copy Markdown

Updates

  • Affected products

Comments
The affected range on this advisory is a single <= 5.0.7, but the source advisory published by the maintainer declares four distinct ranges with per-major backported patches:

GHSA-mh99-v99m-4gvg

— < 1.1.17 (patched 1.1.17), >= 2.0.0 < 2.1.3 (patched 2.1.3), >= 3.0.0 < 3.0.3 (patched 3.0.3), 4.0.0 - 5.0.7 (patched 5.0.8).

The fix was backported to the 1.x, 2.x and 3.x maintenance lines. brace-expansion 1.1.17 introduces EXPANSION_MAX_LENGTH and a bounded combine(), with a source comment naming CVE-2026-14257 directly; 2.1.3 and 3.0.3 carry the equivalent change.

Because the current range is expressed as a single <= 5.0.7, the patched 1.x/2.x/3.x releases still satisfy it and the alert cannot be cleared by upgrading. This affects any project on minimatch 3.x/9.x, which depend on brace-expansion@^1.1.7 / ^2.0.2 and cannot move to 5.x — v5's CommonJS entry exports { expand } rather than a callable, so it is not a drop-in.

Every other brace-expansion advisory in the database already uses per-major ranges (GHSA-3jxr-9vmj-r5cp, GHSA-f886-m6hf-6m8v, GHSA-v6h2-p8h4-qcjw), so this appears to be a transcription error at intake rather than an intentional widening.

@github

github commented Jul 31, 2026

Copy link
Copy Markdown
Collaborator

Hi there @juliangruber! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

Copilot AI review requested due to automatic review settings July 31, 2026 08:27
@github-actions
github-actions Bot changed the base branch from main to thedavidthomas/advisory-improvement-8916 July 31, 2026 08:28

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Corrects the advisory’s affected versions to reflect patched maintenance releases.

Changes:

  • Splits the broad range into four major-version ranges.
  • Records fixes in 1.1.17, 2.1.3, 3.0.3, and 5.0.8.
  • Removes misleading aggregate affected-range metadata.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@helixplant

Copy link
Copy Markdown

Closing as this is a duplicate of #8832.

@helixplant helixplant closed this Jul 31, 2026
@github-actions
github-actions Bot deleted the thedavidthomas-GHSA-mh99-v99m-4gvg branch July 31, 2026 15:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants