CVE-2026-69152 in brace-expansion
Summary
by MITRE • 08/03/2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
The brace-expansion library vulnerability represents a critical memory exhaustion issue that affects multiple version branches of this widely-used npm package. This flaw resides in the expand() function's handling of comma-alternative intermediate arrays and padded sequences, where the maxLength parameter is not consistently enforced during string construction operations. The vulnerability stems from insufficient input validation and resource management within the library's core processing logic, creating a pathway for attackers to craft malicious inputs that can cause excessive memory allocation and event loop blocking.
The technical implementation of this vulnerability exploits the library's brace expansion algorithm by leveraging attacker-controlled input to generate arbitrarily long strings through common prefix and suffix patterns. When processing such inputs, the expand() function fails to apply proper length constraints during intermediate array construction phases, allowing malicious payloads to grow unchecked and consume system resources. This issue specifically affects versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, indicating a long-standing flaw that was not properly addressed in previous patches, as evidenced by the bypass of CVE-2026-14257 mitigation efforts.
Operationally, this vulnerability presents significant risks to applications relying on brace expansion functionality, particularly those processing untrusted user input or external data sources. The memory exhaustion potential can lead to denial of service conditions where applications become unresponsive or crash entirely due to resource depletion. Event loop blocking represents a more insidious threat as it affects the responsiveness of Node.js applications, potentially causing cascading failures in web services and APIs that depend on timely processing of requests. Systems running vulnerable versions may experience gradual performance degradation followed by complete service disruption when exploited with carefully crafted inputs.
The mitigation strategy requires immediate upgrade to patched versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9, which implement proper maxLength enforcement during intermediate array construction. Organizations should also consider implementing input validation layers at application boundaries to limit the size and complexity of brace expansion operations, particularly when processing external data. Security monitoring should be enhanced to detect unusual memory usage patterns or request processing times that may indicate exploitation attempts. Additionally, developers should conduct comprehensive testing of all brace expansion functionality within their applications to ensure proper resource management and prevent similar vulnerabilities in custom implementations.
This vulnerability aligns with CWE-400, which addresses uncontrolled resource consumption, and relates to ATT&CK technique T1499.004 for network denial of service attacks. The flaw demonstrates poor input sanitization practices and inadequate bounds checking that are common in parsing libraries handling complex string manipulation operations. The bypass of CVE-2026-14257 indicates that previous security measures were incomplete, suggesting the need for more thorough vulnerability assessment and remediation processes within the software supply chain to prevent similar oversight in future security updates.