StackRadar

CVE-2026-14257

High

Advisory

Published 23 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
948
of 17,790 indexed, latest versions
Container images
985
deployed by those charts
Fix available
2 of 3
affected packages

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

Carried by container images the latest versions of 948 of 17,790 indexed charts deploy, on 985 images.

Affected packageAffected versionsFixed inImages
brace-expansionnpm1.1.1, 1.1.2, 1.1.4, 1.1.6+19 more1.1.17, 2.1.3, 5.0.8985
node-brace-expansiondeb1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1, 2.0.1+~1.1.0-2no fix listed7
npmapk11.17.0-r012.0.1-r21
OSV records
CGA-6hf9-6j4p-2q3vDEBIAN-CVE-2026-14257GHSA-mh99-v99m-4gvgUBUNTU-CVE-2026-14257
Also known as
CGA-mwqw-7q2r-9q5w

Charts affected

948 by stars
ChartLatestAffected imagesRadar Score
web-checkhajowielandVerified publisher1.0.11 of 1See more

web-check hajowieland 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latesta4e021c0f6a9
brace-expansion@2.0.2
2.1.3

Open the chart page →

8,798
gitter-irc-bridgehalkeye0.1.11 of 1See more

gitter-irc-bridge halkeye 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
halkeye/gitter-slack-bridge:v2.0.153eb2b3cd4cb
brace-expansion@1.1.11
1.1.17

Open the chart page →

3,642
hubothalkeye0.0.11 of 1See more

hubot halkeye 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
halkeye/hubot:latest9764d2202130
brace-expansion@1.1.11
1.1.17

Open the chart page →

2,116
irslackdhalkeye0.1.01 of 1See more

irslackd halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
halkeye/irslackd:latest7638bfba70b0
brace-expansion@1.1.11
1.1.17

Open the chart page →

2,064
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
brace-expansion@1.1.11
1.1.17

Open the chart page →

3,003
theloungehalkeye4.3.11 of 1See more

thelounge halkeye 4.3.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
thelounge/thelounge:4.3.0-alpine0037aa258261
brace-expansion@1.1.11
1.1.17

Open the chart page →

1,938
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
brace-expansion@1.1.11
1.1.17

Open the chart page →

23,472
7dtdhelm-7dtd0.1.01 of 1See more

7dtd helm-7dtd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
vinanrra/7dtd-server:v0.4.4f9534490bd2b
brace-expansion@1.1.11
1.1.17

Open the chart page →

10,655
home-assistant-matter-hubhelm-chart-roeiVerified publisher3.0.21 of 1See more

home-assistant-matter-hub helm-chart-roei 3.0.2

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
luligu/matterbridge:3.0.28f97884bebc2
brace-expansion@2.0.1
2.1.3

Open the chart page →

3,818
zigbee2mqtthelm-chart-roeiVerified publisher1.19.01 of 1See more

zigbee2mqtt helm-chart-roei 1.19.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
brace-expansion@1.1.11
1.1.17

Open the chart page →

2,173
iofoghelm-chartsVerified publisher0.1.11 of 3See more

iofog helm-charts 0.1.1

1 of the 3 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
brace-expansion@1.1.11
1.1.17

Open the chart page →

24,174
streamsheetshelm-chartsVerified publisher0.2.35 of 8See more

streamsheets helm-charts 0.2.3

5 of the 8 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-base:2.4.00cf25ed621e2
brace-expansion@1.1.11
1.1.17
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
brace-expansion@1.1.11
1.1.17
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
brace-expansion@1.1.11
1.1.17
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
brace-expansion@1.1.11
1.1.17
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
brace-expansion@1.1.11
1.1.17

Open the chart page →

89,949
nodeapphelmcharts0.1.41 of 1See more

nodeapp helmcharts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
kaushaln1/helm_node_app:lateste9f2d5dfdba0
brace-expansion@2.0.1
2.1.3

Open the chart page →

948
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
brace-expansion@1.1.11
1.1.17

Open the chart page →

8,213
hoppscotchhelm-charts-nr0.3.11 of 1See more

hoppscotch helm-charts-nr 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
brace-expansion@2.0.1
2.1.3

Open the chart page →

3,451
crucixhelm-crucix0.2.01 of 1See more

crucix helm-crucix 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/calesthio/crucix:latest67c5244b6acf
brace-expansion@2.0.2
2.1.3

Open the chart page →

778
affinehelmforgeVerified publisher1.0.01 of 3See more

affine helmforge 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
brace-expansion@2.0.2
2.1.3

Open the chart page →

3,895
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
brace-expansion@5.0.5
5.0.8

Open the chart page →

7,648
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
brace-expansion@1.1.11
1.1.17

Open the chart page →

5,794
bytestashhelmforgeVerified publisher1.0.01 of 1See more

bytestash helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
brace-expansion@2.0.2
2.1.3

Open the chart page →

739
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
brace-expansion@2.0.1
2.1.3

Open the chart page →

18,923
croniclehelmforgeVerified publisher1.1.101 of 1See more

cronicle helmforge 1.1.10

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
soulteary/cronicle:0.9.80ac2512fa6e39
brace-expansion@2.0.1
2.1.3

Open the chart page →

1,271
dawarichhelmforgeVerified publisher1.0.11See more

dawarich helmforge 1.0.1

1 container image this version deploys carries CVE-2026-14257.

Container imageDigestPackageFixed in
freikin/dawarich:1.14.511826c67e4b1
brace-expansion@5.0.7
node-brace-expansion@2.0.1+~1.1.0-2
5.0.8
no fix listed

Open the chart page →

—
ghosthelmforgeVerified publisher1.2.71See more

ghost helmforge 1.2.7

1 container image this version deploys carries CVE-2026-14257.

Container imageDigestPackageFixed in
library/ghost:6.63.0e05bc1169fb2
brace-expansion@1.1.15
1.1.17

Open the chart page →

—
homarrhelmforgeVerified publisher1.2.91See more

homarr helmforge 1.2.9

1 container image this version deploys carries CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/homarr-labs/homarr:v1.77.11f5b892aeef4
brace-expansion@5.0.6
5.0.8

Open the chart page →

—
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
brace-expansion@5.0.7
5.0.8

Open the chart page →

11,080
memoshelmforgeVerified publisher2.0.01 of 2See more

memos helmforge 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
brace-expansion@5.0.7
5.0.8

Open the chart page →

793
middlewarehelmforgeVerified publisher1.2.61 of 4See more

middleware helmforge 1.2.6

1 of the 4 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
middlewareeng/middleware:0.3.1747d880812f1
brace-expansion@2.0.1
2.1.3

Open the chart page →

9,704
opencuthelmforgeVerified publisher1.1.91 of 5See more

opencut helmforge 1.1.9

1 of the 5 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
helmforge/opencut:v0.3.0bf11156e0ab5
brace-expansion@5.0.6
5.0.8

Open the chart page →

3,751
paprahelmforgeVerified publisher1.0.01 of 1See more

papra helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/papra-hq/papra:26.6.2-rootlessa281cb44176d
brace-expansion@5.0.7
5.0.8

Open the chart page →

2,536
pocket-idhelmforgeVerified publisher1.0.01 of 2See more

pocket-id helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
library/node:24.21.0-alpine3.23159fe6464903
brace-expansion@5.0.7
5.0.8

Open the chart page →

455
reactive-resumehelmforgeVerified publisher1.0.02 of 4See more

reactive-resume helmforge 1.0.0

2 of the 4 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
brace-expansion@5.0.7
5.0.8
ghcr.io/amruthpillai/reactive-resume:v5.3.0c487ec5edcfe
brace-expansion@5.0.7
5.0.8

Open the chart page →

2,986
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
brace-expansion@2.0.1
2.1.3

Open the chart page →

5,916
twentyhelmforgeVerified publisher1.0.11See more

twenty helmforge 1.0.1

1 container image this version deploys carries CVE-2026-14257.

Container imageDigestPackageFixed in
library/node:24.21.0-alpinebe80f76cf40e
brace-expansion@5.0.7
5.0.8

Open the chart page →

—
uptime-kumahelmforgeVerified publisher1.5.131See more

uptime-kuma helmforge 1.5.13

1 container image this version deploys carries CVE-2026-14257.

Container imageDigestPackageFixed in
louislam/uptime-kuma:2.5.4917318f9d7be
brace-expansion@2.0.2
2.1.3

Open the chart page →

—
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
brace-expansion@2.0.1
2.1.3

Open the chart page →

25,099
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
brace-expansion@1.1.11
1.1.17

Open the chart page →

4,253
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
brace-expansion@2.0.1
2.1.3

Open the chart page →

3,615
http-folderhttp-folder2.0.01 of 1See more

http-folder http-folder 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
aureliengasser/http-folder:1.1.111c4318c2571
brace-expansion@1.1.11
1.1.17

Open the chart page →

1,847
townsquarehuscker-chartsVerified publisher1.0.41 of 2See more

townsquare huscker-charts 1.0.4

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/huscker/townsquare-backend:2.15.2e106681e7673
brace-expansion@1.1.11
1.1.17

Open the chart page →

3,355
crypto-watchdoghuseyinnurbaki0.1.01 of 1See more

crypto-watchdog huseyinnurbaki 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
hhaluk/crypto-watchdog:0.4.0a6555953d941
brace-expansion@1.1.11
1.1.17

Open the chart page →

2,656
ibm-app-navigatoribm-charts1.0.12 of 5See more

ibm-app-navigator ibm-charts 1.0.1

2 of the 5 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ibmcom/app-nav-init:1.0.1240ff499eb5b
brace-expansion@1.1.8
1.1.17
ibmcom/app-nav-ui:1.0.1e2a86997b36b
brace-expansion@1.1.8
1.1.17

Open the chart page →

32,911
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
brace-expansion@1.1.11
1.1.17
ibmcom/bai-setup-dev:19.0.2b8e8df11072d
brace-expansion@1.1.11
1.1.17

Open the chart page →

39,343
ibm-kerify-devibm-charts1.0.01 of 1See more

ibm-kerify-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ibmcom/icp-sert-bats:3.2.0b558f2b444ae
brace-expansion@1.1.11
1.1.17

Open the chart page →

8,221
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
brace-expansion@1.1.8
1.1.17
ibmcom/microclimate-portal:latested5505e5c7ec
brace-expansion@1.1.11
1.1.17
ibmcom/microclimate-theia:lateste17bdccc5030
brace-expansion@1.1.11
1.1.17

Open the chart page →

57,728
ibm-voice-gateway-devibm-charts3.1.01 of 2See more

ibm-voice-gateway-dev ibm-charts 3.1.0

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ibmcom/voice-gateway-mr:1.0.5.00762ab1df6c1
brace-expansion@1.1.11
1.1.17

Open the chart page →

4,504
iframelyiframelyVerified publisher2.3.51 of 1See more

iframely iframely 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
brace-expansion@2.0.1
2.1.3

Open the chart page →

3,181
bluesky-pdsijmacd1.0.01 of 2See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ghcr.io/bluesky-social/pds:0.4d95725b24dbe
brace-expansion@5.0.6
5.0.8

Open the chart page →

9,032
ilum-marquezilumVerified publisher6.7.01 of 3See more

ilum-marquez ilum 6.7.0

1 of the 3 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ilum/marquez-web:0.53.2716437a51a6c
brace-expansion@2.0.2
2.1.3

Open the chart page →

6,282
ilum-uiilumOfficialVerified publisher6.7.31 of 2See more

ilum-ui ilum 6.7.3

1 of the 2 container images this version deploys carry CVE-2026-14257.

Container imageDigestPackageFixed in
ilum/ui:6.7.3998937726679
brace-expansion@2.0.2
2.1.3

Open the chart page →

1,236

Container images carrying it

985 by charts deploying them

A fixed version is listed for 2 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
brace-expansion@5.0.5
5.0.8
1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
brace-expansion@1.1.8
1.1.17
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
brace-expansion@2.0.0
2.1.3
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
brace-expansion@1.1.11
1.1.17
1
quay.io/ibmgaragecloud/nodejs:latest01c3b7acb301
brace-expansion@1.1.11
1.1.17
1
quay.io/ibmgaragecloud/slack-notifications:latest041df93e2bac
brace-expansion@1.1.11
1.1.17
1
quay.io/kuberay/dashboard:v1.7.07e43d4b4fd9f
brace-expansion@5.0.6
5.0.8
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
brace-expansion@2.0.2
2.1.3
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
brace-expansion@2.0.2
2.1.3
1
quay.io/mittwald/kube-mail:latest04f1099241fc
brace-expansion@1.1.12
1.1.17
1
quay.io/mongodb/farm-intro-frontend:0.199ccdfd543e1
brace-expansion@1.1.11
1.1.17
1
quay.io/netwarps/blockscoutbecd3e39360a
brace-expansion@1.1.11
1.1.17
1
quay.io/netwarps/walletconnect-relay:v2.1.3-rc.15d90b9c193e0
brace-expansion@2.0.1
2.1.3
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
brace-expansion@2.0.1
2.1.3
1
quay.io/renokico/laravel-helm-demo:0.6.03207f957e80c
brace-expansion@1.1.11
1.1.17
1
quay.io/renokico/laravel-helm-demo:worker-0.6.04b188259267e
brace-expansion@1.1.11
1.1.17
1
quay.io/renokico/laravel-helm-demo:octane-0.6.0cad83090c58f
brace-expansion@1.1.11
1.1.17
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
brace-expansion@1.1.8
1.1.17
1
quay.io/seamware/fdsc-dashboard:0.6.0f7706c316c5a
brace-expansion@2.0.1
2.1.3
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
brace-expansion@2.0.2
2.1.3
1
quay.io/soketi/k8soketi:0.1-18-debian4cd9ea9434c4
brace-expansion@2.0.1
2.1.3
1
quay.io/soketi/pws:0.8-16-alpine399d2e6b10ef
brace-expansion@1.1.11
1.1.17
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
brace-expansion@2.0.1
2.1.3
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
brace-expansion@1.1.11
1.1.17
1
quay.io/wekan/wekan:v5.65cb17600883a3
brace-expansion@1.1.11
1.1.17
1
quay.io/wi_stefan/consent-manager:0.0.656399619568b
brace-expansion@2.0.1
2.1.3
1
quay.io/wraft/wraft-frontend:latestf1bbbd5e9bb9
brace-expansion@2.0.1
2.1.3
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
brace-expansion@5.0.4
5.0.8
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
brace-expansion@1.1.11
1.1.17
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
brace-expansion@1.1.12
1.1.17
1
registry.gitlab.com/evolves-fr/s3-browser:0.4.1c350c941fe7b
brace-expansion@2.0.2
2.1.3
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
brace-expansion@1.1.11
1.1.17
1
registry.gitlab.com/timvisee/send:v3.4.2047986cf6ef69
brace-expansion@1.1.11
1.1.17
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
brace-expansion@2.0.1
2.1.3
1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw:1.91.3ed44d81a65de
brace-expansion@5.0.6
5.0.8
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.