CVE-2026-69152

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.18 brace-expansion versions prior to 2.1.4 brace-expansion versions prior to 3.0.6 brace-expansion versions prior to 5.0.9

Description An issue exists where the expand() function fails to properly apply the maxLength limit when constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to cause memory exhaustion, leading to an uncatchable out-of-memory error that crashes the Node process, or to block the event loop, causing a denial of service. The memory exhaustion occurs because alternatives in a brace expansion are expanded independently, allowing the cumulative size of the results to exceed the heap limit before truncation occurs. Additionally, padded sequences ignore the maxLength limit during generation, resulting in excessive CPU usage proportional to the sequence width and count.

Recommendations Update brace-expansion to version 1.1.18 or later. Update brace-expansion to version 2.1.4 or later. Update brace-expansion to version 3.0.6 or later. Update brace-expansion to version 5.0.9 or later. As a temporary workaround, avoid passing untrusted input to the expand() function or to glob brace patterns, or provide explicitly small max and maxLength values.