Is CVE-2026-69152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69152 being exploited in the wild.

How severe is CVE-2026-69152?

High severity, with a CVSS score of 7.5, published 3 August 2026.

Which products and versions are affected?

brace-expansion (npm) SEMVER:introduced=0,fixed=1.1.18.

Is there a fix for CVE-2026-69152?

Yes. brace-expansion (npm): upgrade to 1.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69152 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-69152?

Check whether you run brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69152: juliangruber brace-expansion Denial of Service via unbounded arrays

CVE-2026-69152 · Severity: high · CVSS 7.5 · Published 2026-08-03

A vulnerability in the brace-expansion library, which is used to expand shell-like patterns, can allow an attacker to crash or freeze a Node.js application. By providing a specially crafted input string, an attacker can cause the server to run out of memory or consume excessive CPU, leading to a denial of service. This issue bypasses previous security fixes and can affect any application that processes untrusted search patterns or file paths.

Technologies: brace-expansion (npm). Vendors: npm.

Quick answers

Is CVE-2026-69152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69152 being exploited in the wild.
How severe is CVE-2026-69152?: High severity, with a CVSS score of 7.5, published 3 August 2026.
Which products and versions are affected?: brace-expansion (npm) SEMVER:introduced=0,fixed=1.1.18.
Is there a fix for CVE-2026-69152?: Yes. brace-expansion (npm): upgrade to 1.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69152 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-69152?: Check whether you run brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

brace-expansion (npm): upgrade to 1.1.18 or later
```
npm install brace-expansion@1.1.18
```

Technical details

The library fails to properly bound intermediate arrays during the expansion process, leading to uncontrolled resource consumption (CWE-400, CWE-770). Specifically, comma-separated alternatives in braces can accumulate results in an intermediate 'values' array without a cumulative length limit, leading to uncatchable out-of-memory (OOM) errors in Node.js. Additionally, padded sequences in expandSequence() do not respect the maxLength limit during generation, allowing for CPU exhaustion through long-running event loop stalls. These issues bypass the mitigation introduced in CVE-2026-14257. Patches are available in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Affected products

juliangruber brace-expansion < 1.1.18, >= 2.0.0 < 2.1.4, >= 3.0.0 < 3.0.6, >= 4.0.0 < 5.0.9

Identifiers

CVE-2026-69152
GHSA-rgw5-rvv9-x895

Timeline

2026-07-30: patched: Fixes released in multiple major versions
2026-08-03: advisory: GitHub Advisory GHSA-rgw5-rvv9-x895 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.