CVE-2026-69152

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

7.5 HighFix available

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.65%Up 0.3 points since Aug 4, 2026

What each source reports

CVE List Score used 7.5

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Record: CVE-2026-69152
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-52370 7.5

Record: EUVD-2026-52370
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rgw5-rvv9-x895 7.5

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary

The maxLength mitigation added in 5.0.8 for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are combined, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an uncatchable out-of-memory error, so try/catch around expand() does not help.

A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.

Details

maxLength was enforced in combine(), the single place output grows. Two arrays are built before combine() runs, and neither was bounded.

1. Comma alternatives accumulate without a running total (memory exhaustion)

Each alternative in {a,b,c,...} is expanded by its own recursive expand_() call, so each receives a full, independent maxLength allowance. The results were then concatenated into a single values array with no cumulative limit:

values = []
for (let j = 0; j < n.length; j++) {
  values.push.apply(values, expand_(n[j], max, maxLength, false))
}

acc = combine(acc, pre, values, max, maxLength, ...)

With A alternatives, values can reach A * maxLength characters before combine() gets a chance to truncate it. At the default maxLength of 4,000,000 and 400 alternatives, that is well past any default heap.

2. Padded sequences ignore maxLength while generating (CPU exhaustion)

expandSequence() was bounded by max (the result count) but never consulted maxLength. A padded sequence's element width follows the input, so {0...01..100000} with a wide pad generates max elements, each as wide as the input, only for combine() to discard all but a handful.

Memory stays flat here, because V8 represents the padded strings as cons-strings, which is likely why this path was not caught alongside the original issue. The cost is time: work proportional to max * width.

| pad width | input bytes | results kept | time (5.0.8) | time (patched) | |---|---|---|---|---| | 20,000 | 20 KB | 199 | ~7.3 s | ~20 ms | | 100,000 | 100 KB | 39 | ~32 s | ~20 ms | | 400,000 | 400 KB | 9 | ~124 s | ~18 ms |

Output is byte-identical before and after the fix; only the wasted work is removed.

Proof of concept

Memory exhaustion, against 5.0.8:

import { expand } from 'brace-expansion'

const part = '{' + '0'.repeat(50) + '1..100000}'
const input = '{' + Array(400).fill(part).join(',') + '}'  // ~25 KB

try {
  expand(input)
} catch (e) {
  // never reached - the process is already dead
}

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
Aborted

Event-loop stall, against 5.0.8:

import { expand } from 'brace-expansion'

// ~400 KB input, returns 9 results after roughly two minutes of blocking CPU
expand('{' + '0'.repeat(400_000) + '1..100000}')

Impact

Denial of service. Any application that passes attacker-controlled input to expand(), directly or transitively through a glob or pattern-matching library, can be remotely crashed or stalled. The out-of-memory variant terminates the process and cannot be handled with try/catch.

Applications already on 5.0.8 are affected: the 5.0.8 mitigation does not cover these paths.

Patches

Both intermediate arrays are now bounded as they are built, using the same max and maxLength limits already applied in combine():

values tracks a running result count and character length while alternatives are appended, and stops once either bound is reached.
expandSequence() accepts maxLength and stops generating once the sequence's own characters reach it.

As with the existing limits, output is truncated rather than allowed to grow without bound, which matches how max already behaves. The defaults sit well above any realistic expansion, so legitimate input is unaffected.

Workarounds

If upgrading is not immediately possible,…

Record: GHSA-rgw5-rvv9-x895
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-770
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-69152
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-770
Updated: 2026-11-02

OSV 7.5

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Record: CVE-2026-69152
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-770
Updated: 2026-11-02

OSVGHSA-rgw5-rvv9-x895 7.5

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Summary

A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.

Details

maxLength was enforced in combine(), the single place output grows. Two arrays are built before combine() runs, and neither was bounded.

1. Comma alternatives accumulate without a running total (memory exhaustion)

values = []
for (let j = 0; j < n.length; j++) {
  values.push.apply(values, expand_(n[j], max, maxLength, false))
}

acc = combine(acc, pre, values, max, maxLength, ...)

2. Padded sequences ignore maxLength while generating (CPU exhaustion)

Output is byte-identical before and after the fix; only the wasted work is removed.

Proof of concept

Memory exhaustion, against 5.0.8:

import { expand } from 'brace-expansion'

const part = '{' + '0'.repeat(50) + '1..100000}'
const input = '{' + Array(400).fill(part).join(',') + '}'  // ~25 KB

try {
  expand(input)
} catch (e) {
  // never reached - the process is already dead
}

FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory
Aborted

Event-loop stall, against 5.0.8:

import { expand } from 'brace-expansion'

// ~400 KB input, returns 9 results after roughly two minutes of blocking CPU
expand('{' + '0'.repeat(400_000) + '1..100000}')

Impact

Applications already on 5.0.8 are affected: the 5.0.8 mitigation does not cover these paths.

Patches

Both intermediate arrays are now bounded as they are built, using the same max and maxLength limits already applied in combine():

values tracks a running result count and character length while alternatives are appended, and stops once either bound is reached.
expandSequence() accepts maxLength and stops generating once the sequence's own characters reach it.

Workarounds

If upgrading is not immediately possible,…

Record: GHSA-rgw5-rvv9-x895
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-770
Updated: 2026-11-02

Show 48 moreShow less

OSVRHSA-2026:50079 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:50079
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:50290 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:50290
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:50826 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:50826
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:52841 7.5

Red Hat Security Advisory: nodejs-nodemon security update

Record: RHSA-2026:52841
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:54183 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:54183
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:54371 8.6

Red Hat Security Advisory: nodejs:24 security update

Record: RHSA-2026:54371
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:54389 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:54389
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:54436 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record: RHSA-2026:54436
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:54530 8.6

Red Hat Security Advisory: nodejs:22 security update

Record: RHSA-2026:54530
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55541 8.6

Red Hat Security Advisory: nodejs22 security update

Record: RHSA-2026:55541
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55601 8.6

Red Hat Security Advisory: nodejs:22 security update

Record: RHSA-2026:55601
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:55603 8.6

Red Hat Security Advisory: nodejs:24 security update

Record: RHSA-2026:55603
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:57590 8.6

Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

Record: RHSA-2026:57590
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:58819 8.6

Red Hat Security Advisory: nodejs24 security update

Record: RHSA-2026:58819
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:61374 7.5

Red Hat Security Advisory: nodejs-nodemon security update

Record: RHSA-2026:61374
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:62416 8.6

Red Hat Security Advisory: nodejs:22 security update

Record: RHSA-2026:62416
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:64817 8.6

Red Hat Security Advisory: nodejs22 security update

Record: RHSA-2026:64817
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:70228 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record: RHSA-2026:70228
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:70229 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record: RHSA-2026:70229
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:70230 8.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.8 security update

Record: RHSA-2026:70230
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:71114 9.9

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Record: RHSA-2026:71114
CVSS 3.1: 9.9 CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:52841 7.5

Important: nodejs-nodemon security update

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.

Security Fix(es):

brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:52841
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRLSA-2026:54371 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:54371
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:54530 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:54530
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55541 8.6

Important: nodejs22 security update

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55541
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55601 8.6

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55601
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:55603 8.6

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:55603
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVRLSA-2026:58819 8.6

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:58819
CVSS 3.1: 8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-69152 7.5

Record: UBUNTU-CVE-2026-69152
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2026:52841 No score

Important: nodejs-nodemon security update

Security Fix(es):

brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:52841
Updated: 2026-11-02

OSVALSA-2026:54371 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:54371
Updated: 2026-11-02

OSVALSA-2026:54530 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:54530
Updated: 2026-11-02

OSVALSA-2026:55541 No score

Important: nodejs22 security update

Security Fix(es):

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55541
Updated: 2026-11-02

OSVALSA-2026:55601 No score

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55601
Updated: 2026-11-02

OSVALSA-2026:55603 No score

Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:55603
Updated: 2026-11-02

OSVALSA-2026:58819 No score

Important: nodejs24 security update

Security Fix(es):

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification (CVE-2026-54272)
brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:58819
Updated: 2026-11-02

OSVAZL-94526 No score

CVE-2026-69152 affecting package js-jquery 3.5.0-4

Record: AZL-94526
Updated: 2026-11-05

OSVAZL-94532 No score

CVE-2026-69152 affecting package nodejs-nodemon 2.0.3-5

Record: AZL-94532
Updated: 2026-11-05

OSVCLSA-2026-1781830545 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.1.

Record: CLSA-2026-1781830545
Updated: 2026-11-02

OSVCLSA-2026-1781830551 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.1.

Record: CLSA-2026-1781830551
Updated: 2026-11-02

OSVCLSA-2026-1790252886 No score

nodejs: Fix of 5 CVEs

CVE-2026-14257: bound the total number of characters brace expansion may accumulate in the bundled npm brace-expansion copies, so chained brace groups can no longer grow every result until the process dies with an uncatchable out-of-memory error
CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar copy, both when decoding a base-256 header field and when parsing a pax size record, so a crafted archive can no longer stall tar.replace on a scan that never advances past the same header
CVE-2026-69152: charge the intermediate arrays built for comma alternatives and padded sequences against that same length budget, closing a bypass that exhausted memory before the CVE-2026-14257 bound could take effect

Record: CLSA-2026-1790252886
Updated: 2026-11-02

OSVCLSA-2026-1790253961 No score

nodejs: Fix of 5 CVEs

CVE-2026-14257: bound the total number of characters brace expansion may accumulate in the bundled npm brace-expansion copies, so chained brace groups can no longer grow every result until the process dies with an uncatchable out-of-memory error
CVE-2026-59874: refuse a negative entry size in the bundled npm node-tar copy, both when decoding a base-256 header field and when parsing a pax size record, so a crafted archive can no longer stall tar.replace on a scan that never advances past the same header
CVE-2026-69152: charge the intermediate arrays built for comma alternatives and padded sequences against that same length budget, closing a bypass that exhausted memory before the CVE-2026-14257 bound could take effect

Record: CLSA-2026-1790253961
Updated: 2026-11-02

OSVCLSA-2026-1791200030 No score

TuxCare security update for brace-expansion (2 CVEs)

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 1.1.16-tuxcare.4.

Record: CLSA-2026-1791200030
Updated: 2026-11-02

OSVCLSA-2026-1791201412 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.1.

Record: CLSA-2026-1791201412
Updated: 2026-11-02

OSVCLSA-2026-1791201416 No score

TuxCare security update for brace-expansion (1 CVE)

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.1.

Record: CLSA-2026-1791201416
Updated: 2026-11-02

OSVCLSA-2026-1791798665 No score

TuxCare security update for brace-expansion (6 CVEs)

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.

Record: CLSA-2026-1791798665
Updated: 2026-11-02

OSVCLSA-2026-1791806331 No score

TuxCare security update for brace-expansion (4 CVEs)

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 5.0.4-tuxcare.3.

Record: CLSA-2026-1791806331
Updated: 2026-11-02

OSVCLSA-2026-1792232943 No score

TuxCare security update for brace-expansion (3 CVEs)

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 1.1.14-tuxcare.4.

Record: CLSA-2026-1792232943
Updated: 2026-11-02

Affected products

juliangruber brace-expansion

Affected packages

Affected packages
Package	Affected	Fixed
`brace-expansion` npm	before 1.1.18	1.1.18
`brace-expansion` npm	2.0.0 up to 2.1.4	2.1.4
`brace-expansion` npm	3.0.0 up to 3.0.6	3.0.6
`brace-expansion` npm	4.0.0 up to 5.0.9	5.0.9
`nodejs-nodemon` AlmaLinux:10	before 3.1.14-3.el10_2	3.1.14-3.el10_2
`nodejs` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:24.18.0-3.module_el8.10.0+4250+09238ed4	1:24.18.0-3.module_el8.10.0+4250+09238ed4
`nodejs-devel` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:24.18.0-3.module_el8.10.0+4250+09238ed4	1:24.18.0-3.module_el8.10.0+4250+09238ed4
`nodejs-docs` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:24.18.0-3.module_el8.10.0+4250+09238ed4	1:24.18.0-3.module_el8.10.0+4250+09238ed4
`nodejs-full-i18n` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:24.18.0-3.module_el8.10.0+4250+09238ed4	1:24.18.0-3.module_el8.10.0+4250+09238ed4
`nodejs-libs` AlmaLinux:8 From an advisory covering 6 CVEs	before 1:24.18.0-3.module_el8.10.0+4250+09238ed4	1:24.18.0-3.module_el8.10.0+4250+09238ed4

Show 290 moreShow less

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 4, 2026	affected, aliases, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-69152 is a high vulnerability (CVSS 7.5) in Juliangruber Brace-expansion, published August 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in brace-expansion 1.1.18.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 295 package rows, 692 references and the rest of 2 source descriptions. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 9 source records.