CVE-2026-69152: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help.
A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.
References
- github.com/advisories/GHSA-rgw5-rvv9-x895
- github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
- nvd.nist.gov/vuln/detail/CVE-2026-69152
Code Behaviors & Features
Detect and mitigate CVE-2026-69152 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →