CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
Attackers can cause denial of service by exhausting memory or blocking the event loop via unbounded intermediate arrays in the brace-expansion library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69152?
CVE-2026-69152 is a high-severity denial of service vulnerability in juliangruber brace-expansion, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
Which versions are affected by CVE-2026-69152?
8 open source packages ship an affected version, including brace-expansion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
brace-expansion npm | All versions | 1.1.18 |
brace-expansion npm | All versions | 1.1.18 |
brace-expansion npm | From 2.0.0 | 2.1.4 |
brace-expansion npm | From 2.0.0 | 2.1.4 |
brace-expansion npm | From 3.0.0 | 3.0.6 |
brace-expansion npm | From 3.0.0 | 3.0.6 |
2 more packages
brace-expansion npm | From 4.0.0 | 5.0.9 |
brace-expansion npm | From 4.0.0 | 5.0.9 |
Linux distribution packages (4)
nodejs-nodemon AlmaLinux:10 | All versions | 3.1.14-3.el10_2 |
nodejs-nodemon Red Hat:enterprise_linux:10.2 | All versions | 0:3.1.14-3.el10_2 |
nodejs-nodemon Red Hat:enterprise_linux_eus:10.0 | All versions | 0:3.1.14-3.el10_0 |
nodejs-nodemon Rocky Linux:10 | All versions | 0:3.1.14-3.el10_2 |
Products include Juliangruber Brace-Expansion.
How do I fix CVE-2026-69152?
Upgrade brace-expansion to a fixed version for your release line: 1.1.18, 2.1.4, 3.0.6 or 5.0.9.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-69152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-69152 exists.
Other vulnerabilities in juliangruber brace-expansion
Sources
Also known as ALSA-2026:52841, AZL-94526, AZL-94532, CLEANSTART-2026-AE26966, CLEANSTART-2026-MD19790, CLEANSTART-2026-TE21227 and 58 more.