# CVE-2026-69152: juliangruber brace-expansion Denial of Service via unbounded arrays

Source: https://junglewise.ai/threats/cve-2026-69152-juliangruber-brace-expansion-denial-of-service-via-unbounded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-08-03  
License: CC BY 4.0 with a link back

CVE-2026-69152 · Severity: high · CVSS 7.5 · Published 2026-08-03

A vulnerability in the brace-expansion library, which is used to expand shell-like patterns, can allow an attacker to crash or freeze a Node.js application. By providing a specially crafted input string, an attacker can cause the server to run out of memory or consume excessive CPU, leading to a denial of service. This issue bypasses previous security fixes and can affect any application that processes untrusted search patterns or file paths.

Technologies: [brace-expansion (npm)](https://junglewise.ai/threats/technologies/brace-expansion). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-69152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69152 being exploited in the wild.

**How severe is CVE-2026-69152?** High severity, with a CVSS score of 7.5, published 3 August 2026.

**Which products and versions are affected?** brace-expansion (npm) SEMVER:introduced=0,fixed=1.1.18.

**Is there a fix for CVE-2026-69152?** Yes. brace-expansion (npm): upgrade to 1.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69152 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69152?** Check whether you run brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- brace-expansion (npm): upgrade to 1.1.18 or later

  ```sh
  npm install brace-expansion@1.1.18
  ```


## Technical details

The library fails to properly bound intermediate arrays during the expansion process, leading to uncontrolled resource consumption (CWE-400, CWE-770). Specifically, comma-separated alternatives in braces can accumulate results in an intermediate 'values' array without a cumulative length limit, leading to uncatchable out-of-memory (OOM) errors in Node.js. Additionally, padded sequences in expandSequence() do not respect the maxLength limit during generation, allowing for CPU exhaustion through long-running event loop stalls. These issues bypass the mitigation introduced in CVE-2026-14257. Patches are available in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

## Affected products

- juliangruber brace-expansion < 1.1.18, >= 2.0.0 < 2.1.4, >= 3.0.0 < 3.0.6, >= 4.0.0 < 5.0.9

## Identifiers

- CVE-2026-69152
- GHSA-rgw5-rvv9-x895

## Timeline

- 2026-07-30: patched: Fixes released in multiple major versions
- 2026-08-03: advisory: GitHub Advisory GHSA-rgw5-rvv9-x895 published

## References

- [https://api.github.com/users/G-Rath](https://api.github.com/users/G-Rath)
- [https://github.com/G-Rath](https://github.com/G-Rath)
- [https://api.github.com/users/G-Rath/gists%7B/gist_id%7D](https://api.github.com/users/G-Rath/gists%7B/gist_id%7D)
- [https://api.github.com/users/G-Rath/repos](https://api.github.com/users/G-Rath/repos)
- [https://avatars.githubusercontent.com/u/3151613?v=4](https://avatars.githubusercontent.com/u/3151613?v=4)
- [https://api.github.com/users/G-Rath/events%7B/privacy%7D](https://api.github.com/users/G-Rath/events%7B/privacy%7D)

## Related threats

- [brace-expansion stack exhaustion in deeply nested brace groups](https://junglewise.ai/threats/cve-2026-102278-the-brace-expansion-library-generates-arbitrary-strings)
- [brace-expansion quadratic CPU consumption denial of service](https://junglewise.ai/threats/cve-2026-102277-the-brace-expansion-library-generates-arbitrary-strings)
- [brace-expansion stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-102276-the-brace-expansion-library-generates-arbitrary-strings)
- [juliangruber brace-expansion denial of service via memory exhaustion](https://junglewise.ai/threats/cve-2026-14257-juliangruber-brace-expansion-denial-of-service-via-memory)
- [juliangruber brace-expansion denial of service in expand function](https://junglewise.ai/threats/cve-2026-13149-juliangruber-brace-expansion-denial-of-service-in-expand-function)