This might be a false positive, but package-lock.json around line 5515 looked worth a second pair of eyes.
The project uses brace‑expansion 2.0.3, which is vulnerable to CVE‑2026‑14257. The expand() routine only caps the number of generated entries, not the length of each entry, allowing an attacker to craft a modest‑size pattern that expands to extremely long strings while staying under the count limit. This leads to uncontrolled memory growth and a guaranteed out‑of‑memory crash (DoS). Because many Node.js tools (e.g., minimatch, glob) rely on brace‑expansion, any user‑controlled input that reaches these libraries can bring down the service. The vulnerability is rated HIGH due to its ease of exploitation and complete service disruption.
Something like this might fix it:
*** Begin Patch
*** Update File: package.json
@@
- "brace-expansion": "2.0.3",
+ "brace-expansion": "^5.0.8",
*** End Patch
*** Begin Patch
*** Update File: package-lock.json
@@
- "version": "2.0.3",
- "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
- "integrity": "sha512-...",
+ "version": "5.0.8",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+ "integrity": "sha512-<new‑integrity‑hash>",
*** End Patch
For reference: rule CVE-2026-14257. Rated high.
I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
This might be a false positive, but
package-lock.jsonaround line 5515 looked worth a second pair of eyes.The project uses brace‑expansion 2.0.3, which is vulnerable to CVE‑2026‑14257. The expand() routine only caps the number of generated entries, not the length of each entry, allowing an attacker to craft a modest‑size pattern that expands to extremely long strings while staying under the count limit. This leads to uncontrolled memory growth and a guaranteed out‑of‑memory crash (DoS). Because many Node.js tools (e.g., minimatch, glob) rely on brace‑expansion, any user‑controlled input that reaches these libraries can bring down the service. The vulnerability is rated HIGH due to its ease of exploitation and complete service disruption.
Something like this might fix it:
For reference: rule
CVE-2026-14257. Rated high.I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.