Vulnerability in brace-expansion (CVE-2026-69152)
Summary
Vulnerability in brace-expansion (CVE-2026-69152). Risk of unauthorized operations or information disclosure. Exploitable via maxLength. Mitigation: upgrade to 5.0.9 or later.
Original description
The description as published by the source.
Summary
The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help.
A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.
Details
maxLength was enforced in combine(), the single place output grows. Two arrays are built before combine() runs, and neither was bounded.
1. Comma alternatives accumulate without a running total (memory exhaustion)
Each alternative in {a,b,c,...} is expanded by its own recursive expand_() call, so each receives a full, independent maxLength allowance. The results were then concatenated into a single values array with no cumulative limit:
values = []
for (let j = 0; j < n.length; j++) {
values.push.apply(values, expand_(n[j], max, maxLength, false))
}
acc = combine(acc, pre, values, max, maxLength, ...)
With A alternatives, values can reach A * maxLength characters before combine() gets a chance to truncate it. At the default maxLength of 4,000,000 and 400 alternatives, that is well past any default heap.
2. Padded sequences ignore maxLength while generating (CPU exhaustion)
expandSequence() was bounded by max (t…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-69152 has been found in brace-expansion.
Attackers can target a specific entry point like maxLength over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 7.5/10.
What to do: upgrade brace-expansion to 5.0.9 or later.
If unsure, ask your IT team or search "brace-expansion CVE-2026-69152" on the vendor's site.
CVE-2026-69152 (brace-expansion) — CWE-400 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: maxLength / values / max
Patched: 5.0.9 — apply immediately
Workaround: avoid passing untrusted input to expand() or to glob brace patterns, or pass an explicitly small max and maxLength.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-400) exists in brace-expansion. Attackers reach the vulnerable code path via maxLength without authentication.
Check the vendor advisory for the affected versions of brace-expansion. Attack surface: maxLength / values / max.
Severity: High (CVSS 7.5/10). Risk of unauthorized operations or information disclosure.
Update to 5.0.9.
Workaround: avoid passing untrusted input to expand() or to glob brace patterns, or pass an explicitly small max and maxLength.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'brace-expansion' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'brace-expansion' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
brace-expansionを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
avoid passing untrusted input to `expand()` or to glob brace patterns, or pass an explicitly small `max` **and** `maxLength`.パッチが適用されるまでの応急処置として、avoid passing untrusted input to
expand()or to glob brace patterns, or pass an explicitly smallmaxandmaxLength. を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade brace-expansion to 5.0.9ステージング環境で 5.0.9 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2026-69152 node-brace-expansion
References
- ATLASSIAN JSWSERVER-26942
- exploit github.com
- patch security-advisories@github.com
- patch security-advisories@github.com
- patch security-advisories@github.com
- patch security-advisories@github.com
- web github.com
- web nvd.nist.gov