CVE-2026-69152: juliangruber brace-expansion Denial of Service via unbounded arrays

Executive brief

A vulnerability in the brace-expansion library, which is used to expand shell-like patterns, can allow an attacker to crash or freeze a Node.js application. By providing a specially crafted input string, an attacker can cause the server to run out of memory or consume excessive CPU, leading to a denial of service. This issue bypasses previous security fixes and can affect any application that processes untrusted search patterns or file paths.

Technical details

The library fails to properly bound intermediate arrays during the expansion process, leading to uncontrolled resource consumption (CWE-400, CWE-770). Specifically, comma-separated alternatives in braces can accumulate results in an intermediate 'values' array without a cumulative length limit, leading to uncatchable out-of-memory (OOM) errors in Node.js. Additionally, padded sequences in expandSequence() do not respect the maxLength limit during generation, allowing for CPU exhaustion through long-running event loop stalls. These issues bypass the mitigation introduced in CVE-2026-14257. Patches are available in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Affected products

• juliangruber brace-expansion < 1.1.18, >= 2.0.0 < 2.1.4, >= 3.0.0 < 3.0.6, >= 4.0.0 < 5.0.9

Timeline

• 2026-07-30: patched: Fixes released in multiple major versions
• 2026-08-03: advisory: GitHub Advisory GHSA-rgw5-rvv9-x895 published

References

• https://api.github.com/users/G-Rath
• https://github.com/G-Rath
• https://api.github.com/users/G-Rath/gists%7B/gist_id%7D
• https://api.github.com/users/G-Rath/repos
• https://avatars.githubusercontent.com/u/3151613?v=4
• https://api.github.com/users/G-Rath/events%7B/privacy%7D