CVE-2026-14257 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-14257](https://avd.aquasec.com/nvd/cve-2026-14257) | `HIGH` | `brace-expansion` | `1.1.15` | `5.0.8` | `2026-07-23T14:17:00.25Z` | `2026-07-25T10:18:22.105109942Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:3092ce1b17e5f6ed627e85888c56714ac5c6f3458a714c6f22747d3b32763d60` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:3092ce1b17e5f6ed627e85888c56714ac5c6f3458a714c6f22747d3b32763d60` |
| `public.ecr.aws/lambda/nodejs:22` | `public.ecr.aws/lambda/nodejs@sha256:00aef09a8c02621a48db80a65d0538f5390dece6781be7b57b176dbcac3012f2` |

---

## Description

> brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.

---

### Remediation Steps
- Update the affected package `brace-expansion` from version `1.1.15` to `5.0.8`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

No repository file or test is named. Start by locating the build definitions for the listed Lambda Node.js images and checking how brace-expansion 1.1.15 is introduced; verify that the dependency reaches 5.0.8 in nodejs:latest, :24, and :22, then rerun the image vulnerability scan.

Written by the indexing model from the issue text.