Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | < 1.1.18, >= 2.0.0, < 2.1.4, >= 3.0.0, < 3.0.6, >= 4.0.0, < 5.0.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | nodejs +5 | 1:22.23.1-6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs-nodemon | 3.1.14-3.el10_2 | RHSA-2026:52841 |
| RHEL 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | RHSA-2026:55541 |
| RHEL 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | RHSA-2026:58819 |
| RHEL 10 | rh-podman-desktop | 1.1.2-1.el10_2 | RHSA-2026:57590 |
| RHEL 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24156+bb41d456 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55603, RHSA-2026:55601 |
| RHEL 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+24637+e0b636e5 | RHSA-2026:55601 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+24638+75f46aee | RHSA-2026:55603 |
| RHEL 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24639+56878497 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24500+8eb51621 | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530, RHSA-2026:54371 |
| RHEL 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+24640+6eba5e6e | RHSA-2026:54530 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+24639+56878497 | RHSA-2026:54371 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | nodejs +5 | 1:22.23.2-1.el10_0 | RHSA-2026:64817 |
| RHEL 10.0 EUS | nodejs-nodemon | 3.1.14-3.el10_0 | RHSA-2026:61374 |
| RHEL 10.0 EUS | nodejs-npm | 1:10.9.8-1.22.23.2.1.el10_0 | RHSA-2026:64817 |
| RHEL 9.6 EUS | nodejs +4 | 1:22.23.2-1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-nodemon | 3.1.14-2.module+el9.6.0+24789+4011c12f | RHSA-2026:62416 |
| RHEL 9.6 EUS | nodejs-packaging +1 | 2021.06-4.module+el9.6.0+23473+45664c2d | RHSA-2026:62416 |
| RHEL 9.6 EUS | npm | 1:10.9.8-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| RHEL 9.6 EUS | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.1.module+el9.6.0+24769+299a7e3a | RHSA-2026:62416 |
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-8.redhat_00024.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-apache-cxf +3 | 4.1.7-1.SP1_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-artemis-wildfly-integration | 2.0.5-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.85.0-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-cryptacular | 1.2.7-1.redhat_00002.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.8.0-1.GA_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.6.54-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-httpcomponents-asyncclient | 4.1.5-5.redhat_00008.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-ironjacamar +8 | 3.0.22-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jackson-core +12 | 2.18.9-1.redhat_00003.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jakarta-xml-bind-api | 4.0.5-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jaxb +9 | 4.0.7-4.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jaxbintros | 2.1.0-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jboss-logging | 3.6.3-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jboss-remoting | 5.0.31-1.SP2_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-api | 3.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-common-tools | 2.2.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-cxf | 7.4.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-jaxws-undertow-httpspi | 3.0.1-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jbossws-spi | 5.1.0-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-jsf-impl | 4.0.11-2.SP1_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-log4j | 2.25.4-1.redhat_00003.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-neethi | 3.2.2-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-netty +14 | 4.1.136-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-nimbus-jose-jwt | 9.37.4-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-parsson | 1.1.9-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-saaj-impl +1 | 3.0.6-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-slf4j +1 | 2.0.18-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.26-2.SP3_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.8-9.GA_redhat_00006.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.6.11-1.Final_redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-wildfly-javadocs | 8.1.1-12.GA_redhat_00048.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat JBoss EAP 8 | eap8-ws-commons-XmlSchema | 2.3.2-1.redhat_00001.1.el8eap | RHSA-2026:70230, RHSA-2026:70229, RHSA-2026:70228 |
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.6-0.4.hum1 | RHSA-2026:50290 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.5.1.hum1 | RHSA-2026:50826, RHSA-2026:50079 |
| Red Hat Hardened Images 1 | nodejs22 +6 | 22.23.2-2.3.2.hum1 | RHSA-2026:54436 |
| Red Hat Hardened Images 1 | nodejs22-npm | 10.9.8-1.22.23.2.2.3.2.hum1 | RHSA-2026:54436 |
| Red Hat Hardened Images 1 | nodejs24 +6 | 24.18.1-0.2.1.hum1 | RHSA-2026:54183 |
| Red Hat Hardened Images 1 | nodejs24-npm | 11.16.0-1.24.18.1.0.2.1.hum1 | RHSA-2026:54183 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 26.7.0-1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | nodejs26-npm | 11.19.0-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Hardened Images 1 | v8-12.4-devel | 12.4.254.21-1.22.23.2.2.3.2.hum1 | RHSA-2026:54436 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 13.6.233.17-1.24.18.1.0.2.1.hum1 | RHSA-2026:54183 |
| Red Hat Hardened Images 1 | v8-14.6-devel | 14.6.202.34-1.26.7.0.1.5.2.hum1 | RHSA-2026:54389 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.6.33-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.5.10-8.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260923-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el8ap | RHSA-2026:71114 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el8ap | RHSA-2026:71114 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | nodejs +4 | 1:22.23.1-6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs-nodemon | 3.1.14-3.el10_2 | ALSA-2026:52841 |
| AlmaLinux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.el10_2 | ALSA-2026:55541 |
| AlmaLinux 10 | nodejs24 +4 | 1:24.18.0-5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.el10_2 | ALSA-2026:58819 |
| AlmaLinux 9 | nodejs +4 | 1:22.23.1-3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | npm | 1:10.9.8-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55603, ALSA-2026:55601 |
| AlmaLinux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el9.8.0+291+0bb98cce | ALSA-2026:55601 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:55603 |
| AlmaLinux 8 | nodejs +4 | 1:22.23.1-3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | npm | 1:10.9.8-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530, ALSA-2026:54371 |
| AlmaLinux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5 | ALSA-2026:54530 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4 | ALSA-2026:54371 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | nodejs-nodemon | 3.1.14-3.el10_2 | RLSA-2026:52841 |
| Rocky Linux 10 | nodejs22 | 1:22.23.1-6.el10_2 | RLSA-2026:55541 |
| Rocky Linux 10 | nodejs24 | 1:24.18.0-5.el10_2 | RLSA-2026:58819 |
| Rocky Linux 9 | nodejs | 1:22.23.1-3.module+el9.8.0+40280+057606e8 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:55603, RLSA-2026:55601 |
| Rocky Linux 8 | nodejs | 1:22.23.1-3.module+el8.10.0+40278+50b003a3 | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:54530, RLSA-2026:54371 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:54530, RLSA-2026:54371 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | velociraptor | 0.76.7.0.git145.b60ef1146-1.1 | openSUSE-SU-2026:12070-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.0-1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.0.1.amzn2023.0.1 | ALAS2023-2026-3297 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +1 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | nodejs +4 | 1:22.23.1-6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs-nodemon | 3.1.14-3.el10_2 | ELSA-2026-52841 |
| Oracle Linux 10 | nodejs-npm | 1:10.9.8-1.22.23.1.6.0.1.el10_2 | ELSA-2026-55541 |
| Oracle Linux 10 | nodejs24 +4 | 1:24.18.0-5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 10 | nodejs24-npm | 1:11.16.0-1.24.18.0.5.0.1.el10_2 | ELSA-2026-58819 |
| Oracle Linux 9 | nodejs +4 | 1:22.23.1-3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-2.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+90946+13dc792a | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | npm | 1:10.9.8-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55603, ELSA-2026-55601 |
| Oracle Linux 9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el9.8.0+90991+73acc950 | ELSA-2026-55601 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.6.module+el9.8.0+90993+075b4fd6 | ELSA-2026-55603 |
| Oracle Linux 8 | nodejs +4 | 1:22.23.1-3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-4.module+el8.10.0+90968+e271b286 | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | npm | 1:10.9.8-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530, ELSA-2026-54371 |
| Oracle Linux 8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.1.3.module+el8.10.0+90989+141244df | ELSA-2026-54530 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.3.module+el8.10.0+90988+ddbb43dc | ELSA-2026-54371 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.8-r2 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-suggestion-hyperopt | 0.19.0-r40 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | langfuse-3-worker | 3.225.0-r2 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.7-r3 | — |
| Wolfi rolling | npm-12 | 12.0.2-r2 | — |
| Wolfi rolling | opensearch-dashboards-3 +6 | 3.7.0-r14 | — |
| Wolfi rolling | prism | 5.16.0-r4 | — |
| Wolfi rolling | pulumi-language-nodejs | 3.256.0-r0 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r12 | — |
| Wolfi rolling | renovate | 44.23.3-r0 | — |
| Wolfi rolling | saf | 1.6.0-r4 | — |
| Wolfi rolling | serve | 14.2.6-r5 | — |
| Wolfi rolling | sqlpad | 7.5.7-r31 | — |
| Wolfi rolling | ts-patch | 4.0.1-r42 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | < 1.1.18 | 1.1.18 | GHSA-rgw5-rvv9-x895 |
| npm | brace-expansion | >= 2.0.0, < 2.1.4 | 2.1.4 | GHSA-rgw5-rvv9-x895 |
| npm | brace-expansion | >= 3.0.0, < 3.0.6 | 3.0.6 | GHSA-rgw5-rvv9-x895 |
| npm | brace-expansion | >= 4.0.0, < 5.0.9 | 5.0.9 | GHSA-rgw5-rvv9-x895 |
Advisories 50
- WID-SEC-2026-2816 Red Hat Enterprise Linux (nodejs:24): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-2725 Red Hat Enterprise Linux (brace-expansion): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- ALSA-2026:55601 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:58819 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55541 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:52841 Important: nodejs-nodemon security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:55603 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54371 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:54530 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALAS2023-2026-3297 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Oct 26, 2026
- RHSA-2026:54389 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54436 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:71114 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70230 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70229 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:70228 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:64817 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:62416 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:61374 Red Hat Security Advisory: nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:58819 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55603 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55601 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:55541 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54530 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54371 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54183 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:52841 Red Hat Security Advisory: nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50826 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50290 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50079 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12070-1 velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
- RLSA-2026:58819 Important: nodejs24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55601 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:55603 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54530 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 26, 2026
- RLSA-2026:54371 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 26, 2026
- ELSA-2026-58819 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 25, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- RLSA-2026:55541 Important: nodejs22 security update Rocky Linux Security Advisories · Aug 18, 2026
- ELSA-2026-55601 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55603 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2026
- ELSA-2026-55541 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 17, 2026
- ELSA-2026-54530 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- ELSA-2026-54371 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Aug 14, 2026
- RLSA-2026:52841 Important: nodejs-nodemon security update Rocky Linux Security Advisories · Aug 11, 2026
- ELSA-2026-52841 Important: nodejs-nodemon security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 10, 2026
References
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
- https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031