CVE-2026-69152 Details
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
A denial-of-service vulnerability has been identified in the brace-expansion library, specifically in versions prior to 1.1.18, 2.0.0 through 2.1.4, 3.0.0 through 3.0.6, and 4.0.0 prior to 5.0.9. The issue arises because the expand() function, in these vulnerable versions, does not properly enforce the maxLength parameter when creating intermediate arrays for comma-separated alternatives or padded sequences. This oversight allows attacker-controlled input to consume excessive memory or disrupt the event loop, effectively causing a denial-of-service condition. Notably, this vulnerability bypasses the mitigation implemented for CVE-2026-14257, which is addressed in the library's later versions.
Users can upgrade to brace-expansion versions 1.1.18, 2.1.4, 3.0.6, or 5.0.9, where this vulnerability has been fixed. If an immediate upgrade is not possible, it is recommended to avoid passing untrusted input to the expand() function or to glob patterns, or to specify a small max and maxLength value.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| juliangruber brace-expansion | < 1.1.18 >= 2.0.0, < 2.1.4 >= 3.0.0, < 3.0.6 >= 4.0.0, < 5.0.9 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | New CVE Received | [email protected] |