CVE-2026-69152: Brace-expansion Library DOS Vulnerability

CVE-2026-69152 Overview

CVE-2026-69152 affects brace-expansion, a widely used Node.js library that generates arbitrary strings containing a common prefix and suffix. The expand() function does not apply the maxLength guard while constructing comma-alternative intermediate arrays or padded sequences. Attacker-controlled input can exhaust process memory or block the Node.js event loop, producing a denial-of-service condition. This flaw bypasses the earlier fix for CVE-2026-14257. Maintainers resolved the issue in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Remote, unauthenticated attackers can send crafted brace-expansion input to exhaust memory or stall the event loop, causing service unavailability in any Node.js application that passes untrusted strings to expand().

Affected Products

juliangruber/brace-expansion versions prior to 1.1.18
juliangruber/brace-expansion versions prior to 2.1.4 and prior to 3.0.6
juliangruber/brace-expansion versions prior to 5.0.9

Discovery Timeline

2026-08-03 - CVE-2026-69152 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-69152

Vulnerability Analysis

The brace-expansion library expands shell-style brace patterns such as {a,b,c} and numeric or alphabetical sequences like {1..100} into arrays of concrete strings. A prior fix introduced a maxLength cap intended to bound the size of the output. That cap was enforced at the outer expansion boundary but not consistently propagated into helper routines that build intermediate arrays.

Specifically, expandSequence() and the code paths handling comma-alternative expansions constructed their working arrays before any length check was applied. An attacker can therefore submit patterns that trigger allocation of extremely large intermediate arrays or padded numeric sequences well before the guard rejects the request. The result is either heap exhaustion or a long, synchronous computation that blocks Node.js's single-threaded event loop.

Root Cause

The root cause is missing propagation of the maxLength parameter into expandSequence() and related helpers. Without that bound, sequence generation and comma-alternative combinatorial expansion run unbounded relative to attacker input. The patched code adds maxLength as a parameter to these helpers so the limit is enforced during intermediate construction, not only on the final result.

Attack Vector

Exploitation requires an application that passes untrusted input into brace-expansion.expand(). This pattern is common in file-globbing libraries such as minimatch and downstream dependents used by build tools, package managers, and web frameworks. An unauthenticated network attacker who controls a pattern string, filename, or configuration value fed into these APIs can trigger the resource exhaustion remotely.

javascript

// Security patch for expandSequence in index.js
 function expandSequence(
   body,
   isAlphaSequence,
-  max
+  max,
+  maxLength
 ) {
   var n = body.split(/\.\./)
   var N = []
// Source: https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac

The patch threads maxLength into expandSequence() so the helper can abort construction of N once the bound is reached, rather than allocating an unbounded intermediate array. An equivalent change was applied to the TypeScript source at src/index.ts in commit 688a99e.

Detection Methods for CVE-2026-69152

Indicators of Compromise

Sustained high memory usage or out-of-memory (OOM) terminations in Node.js processes that parse user-supplied glob or brace patterns.
Event-loop lag warnings, elevated request latency, or worker restarts correlated with specific inbound requests containing large {...} or {N..M} payloads.
HTTP request logs showing unusually long brace-expansion inputs, deeply nested braces, or wide numeric ranges from a single client.

Detection Strategies

Software composition analysis (SCA) against package.json and lockfiles to flag brace-expansion versions below 1.1.18, 2.1.4, 3.0.6, or 5.0.9, including transitive dependencies pulled in by minimatch, glob, and related packages.
Application-layer input validation logging to capture pattern length, brace depth, and numeric range width prior to invoking expand().
Runtime telemetry that correlates event-loop stalls and heap growth with the specific HTTP endpoint and payload that triggered them.

Monitoring Recommendations

Track Node.js process metrics for RSS growth rate, garbage collection frequency, and event-loop delay; alert on sustained deviations from baseline.
Enable web application firewall (WAF) rules that limit request body and query string lengths, and reject inputs with excessive { / , / .. density.
Ingest dependency inventory and runtime process telemetry into a centralized analytics platform to correlate vulnerable package versions with live workloads.

How to Mitigate CVE-2026-69152

Immediate Actions Required

Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, or 5.0.9 depending on the major version in use, and rebuild all Node.js services and container images.
Refresh lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) to ensure transitive dependencies from minimatch, glob, and similar packages resolve to fixed versions.
Audit application code paths that pass untrusted input into brace-expansion, glob, or minimatch APIs and enforce input length and complexity limits.

Patch Information

Maintainer fixes are published in commits 139d015, 1e30c93, 688a99e, and cb4b9e4. Full details are documented in the GitHub Security Advisory GHSA-rgw5-rvv9-x895.

Workarounds

Reject or truncate user-supplied brace patterns above a conservative maximum length before passing them to expand().
Wrap calls to expand() in a worker thread or child process with a hard timeout so a stalled expansion cannot block the main event loop.
Deploy WAF or API gateway rules that cap the size and structural complexity of pattern-bearing parameters.

bash

# Upgrade brace-expansion across supported major versions
npm install brace-expansion@^1.1.18
npm install brace-expansion@^2.1.4
npm install brace-expansion@^3.0.6
npm install brace-expansion@^5.0.9

# Verify the resolved version in the dependency tree
npm ls brace-expansion

# Force transitive dependencies to a fixed version (npm >= 8.3)
# Add to package.json:
#   "overrides": { "brace-expansion": "^2.1.4" }
npm install