- CVE-2026-14257: bound the total number of characters brace expansion may accumulate in the bundled npm brace-expansion copies, so chained brace groups can no longer grow every result until the process dies with an uncatchable out-of-memory error - CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar copy, both when decoding a base-256 header field and when parsing a pax size record, so a crafted archive can no longer stall tar.replace on a scan that never advances past the same header - CVE-2026-69152: charge the intermediate arrays built for comma alternatives and padded sequences against that same length budget, closing a bypass that exhausted memory before the CVE-2026-14257 bound could take effect