CVE-2026-69152: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help.
A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.
References
- github.com/advisories/GHSA-rgw5-rvv9-x895
- github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d
- github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac
- github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf
- github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895
- nvd.nist.gov/vuln/detail/CVE-2026-69152
Code Behaviors & Features
Detect and mitigate CVE-2026-69152 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →