CVE-2026-14257 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-14257	HIGH	brace-expansion	1.1.15	5.0.8	2026-07-23T14:17:00.25Z	2026-07-25T10:18:22.105109942Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:3092ce1b17e5f6ed627e85888c56714ac5c6f3458a714c6f22747d3b32763d60
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:3092ce1b17e5f6ed627e85888c56714ac5c6f3458a714c6f22747d3b32763d60
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:00aef09a8c02621a48db80a65d0538f5390dece6781be7b57b176dbcac3012f2

---

Description

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

---

Remediation Steps

• Update the affected package brace-expansion from version 1.1.15 to 5.0.8.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.