brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54530 advisory.

    - deps: update npm/brace-expansion to 2.1.4       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
    - Backport patch: update sqlite to 3.53.4       Fix: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-224135 RHEL-224144
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-193842 RHEL-193874 RHEL-208661
    - Update to version 22.23.1       Resolves: RHEL-176170       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338
    - Update to version 22.22.2       Resolves: RHEL-154019       Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528
    - Patch fix for sqlite CVE-2025-6965       Resolves: RHEL-103835
    - Update to 22.16.0       Fixes: CVE-2025-23166
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223760
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469
    - Update to 2.0.7 to resolve CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()
    function limits the number of results with a max option (default 100,000) but does not bound the length of
    each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit
    while making each result progressively longer, so total memory scales with both count and string length
    until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input
    ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced
    strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can
    be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds
    accumulated output and intermediate arrays. (CVE-2026-14257)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()     function limits the number of results with a max option (default 100,000) but does not bound the length of     each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit     while making each result progressively longer, so total memory scales with both count and string length     until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input     ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced     strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can     be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds     accumulated output and intermediate arrays. (CVE-2026-14257)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
335749	Oracle Linux 8 : nodejs:22 (ELSA-2026-54530)	Nessus	Oracle Linux Local Security Checks	Local	high
335747	Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)	Nessus	Oracle Linux Local Security Checks	Local	high
445572	SCA: security update for brace-expansion (GHSA-mh99-v99m-4gvg)	Tenable Cloud Security	SCA Checks	Local	high
445572	SCA: security update for brace-expansion (GHSA-mh99-v99m-4gvg)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
329732	Linux Distros Unpatched Vulnerability : CVE-2026-14257	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-14257

high

Tenable Plugins

high

high

high

high

high