High severity7.5NVD Advisory· Published Aug 3, 2026· Updated Aug 5, 2026
CVE-2026-69152
CVE-2026-69152
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
brace-expansionnpm | < 1.1.18 | 1.1.18 |
brace-expansionnpm | >= 2.0.0, < 2.1.4 | 2.1.4 |
brace-expansionnpm | >= 3.0.0, < 3.0.6 | 3.0.6 |
brace-expansionnpm | >= 4.0.0, < 5.0.9 | 5.0.9 |
Affected products
98cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*range: <1.1.18
- (no CPE)range: <1.1.18, <2.1.4, <3.0.6, <5.0.9
- osv-coords95 versionspkg:apk/chainguard/actions-runnerpkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/argo-workflows-ui-3.7pkg:apk/chainguard/argo-workflows-ui-4.0pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/azuritepkg:apk/chainguard/bash-language-serverpkg:apk/chainguard/dotstatsuite-supercorepkg:apk/chainguard/foxx-clipkg:apk/chainguard/gemini-clipkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/gitlab-rails-ce-fips-19.3pkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-4-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/langfuse-fips-4-workerpkg:apk/chainguard/nextcloud-server-31pkg:apk/chainguard/nextcloud-server-33pkg:apk/chainguard/nextcloud-server-34pkg:apk/chainguard/npm-12pkg:apk/chainguard/opensearch-dashboards-2-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3pkg:apk/chainguard/opensearch-dashboards-3-alerting-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-anomaly-detection-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-dashboards-observabilitypkg:apk/chainguard/opensearch-dashboards-3-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3-fipspkg:apk/chainguard/opensearch-dashboards-3-fips-alerting-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-anomaly-detection-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-observabilitypkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3-fips-index-management-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-security-analytics-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-index-management-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-security-analytics-dashboards-pluginpkg:apk/chainguard/opentelemetry-auto-instrumentations-nodepkg:apk/chainguard/pelias-apipkg:apk/chainguard/prismpkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/rancher-api-uipkg:apk/chainguard/redisinsightpkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/servepkg:apk/chainguard/sqlpadpkg:apk/chainguard/tensorflow-gpu-jupyterpkg:apk/chainguard/ts-patchpkg:apk/chainguard/unleashpkg:apk/chainguard/unleash-proxypkg:apk/chainguard/vitess-22pkg:apk/chainguard/wazuh-dashboard-plugins-fipspkg:apk/chainguard/wazuh-dashboard-security-pluginpkg:apk/chainguard/wazuh-dashboard-security-plugin-fipspkg:apk/wolfi/argo-workflows-ui-3.7pkg:apk/wolfi/argo-workflows-ui-4.0pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/nextcloud-server-33pkg:apk/wolfi/npm-12pkg:apk/wolfi/opensearch-dashboards-3pkg:apk/wolfi/opensearch-dashboards-3-alerting-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-anomaly-detection-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-dashboards-observabilitypkg:apk/wolfi/opensearch-dashboards-3-dashboards-reportingpkg:apk/wolfi/opensearch-dashboards-3-index-management-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-security-analytics-dashboards-pluginpkg:apk/wolfi/prismpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/rancher-api-uipkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/servepkg:apk/wolfi/sqlpadpkg:apk/wolfi/ts-patchpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-devel
< 2.336.0-r4+ 94 more
- (no CPE)range: < 2.336.0-r4
- (no CPE)range: < 3.12.9.4-r15
- (no CPE)range: < 3.7.17-r1
- (no CPE)range: < 4.0.8-r2
- (no CPE)range: < 2026.5.6-r3
- (no CPE)range: < 2026.5.6-r3
- (no CPE)range: < 3.35.0-r2
- (no CPE)range: < 5.6.0-r4
- (no CPE)range: < 3.1.0_git20260803-r1
- (no CPE)range: < 2.1.1-r10
- (no CPE)range: < 0.49.0-r7
- (no CPE)range: < 19.3.1-r6
- (no CPE)range: < 18.11.8-r1
- (no CPE)range: < 19.3.1-r3
- (no CPE)range: < 25.0.4-r15
- (no CPE)range: < 3.225.0-r2
- (no CPE)range: < 4.3.1-r1
- (no CPE)range: < 3.224.3-r8
- (no CPE)range: < 4.3.1-r1
- (no CPE)range: < 31.0.14-r6
- (no CPE)range: < 33.0.7-r3
- (no CPE)range: < 34.0.2-r6
- (no CPE)range: < 12.0.2-r2
- (no CPE)range: < 2.19.6-r10
- (no CPE)range: < 2.19.6-r2
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 0.79.0-r2
- (no CPE)range: < 7.8.0-r7
- (no CPE)range: < 5.16.0-r4
- (no CPE)range: < 3.256.0-r0
- (no CPE)range: < 1.2.3-r12
- (no CPE)range: < 3.8.0-r2
- (no CPE)range: < 44.23.3-r1
- (no CPE)range: < 1.7.0-r0
- (no CPE)range: < 14.2.6-r5
- (no CPE)range: < 7.5.7-r31
- (no CPE)range: < 0
- (no CPE)range: < 4.0.1-r42
- (no CPE)range: < 8.0.3-r5
- (no CPE)range: < 1.4.19-r7
- (no CPE)range: < 22.0.4-r17
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 3.7.17-r1
- (no CPE)range: < 4.0.8-r2
- (no CPE)range: < 3.225.0-r2
- (no CPE)range: < 33.0.7-r3
- (no CPE)range: < 12.0.2-r2
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 3.7.0-r14
- (no CPE)range: < 5.16.0-r4
- (no CPE)range: < 3.256.0-r0
- (no CPE)range: < 1.2.3-r12
- (no CPE)range: < 44.23.3-r1
- (no CPE)range: < 1.7.0-r0
- (no CPE)range: < 14.2.6-r5
- (no CPE)range: < 7.5.7-r31
- (no CPE)range: < 4.0.1-r42
- (no CPE)range: < 1:24.18.0-3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 1:24.18.0-3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 1:24.18.0-3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 1:24.18.0-3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 1:24.18.0-3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 3.1.14-3.el10_2
- (no CPE)range: < 1:10.9.8-1.22.23.1.6.el10_2
- (no CPE)range: < 2021.06-6.module_el8.10.0+4086+70facd4a
- (no CPE)range: < 2021.06-6.module_el8.10.0+4086+70facd4a
- (no CPE)range: < 1:24.18.0-5.el10_2
- (no CPE)range: < 1:24.18.0-5.el10_2
- (no CPE)range: < 1:24.18.0-5.el10_2
- (no CPE)range: < 1:24.18.0-5.el10_2
- (no CPE)range: < 1:24.18.0-5.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.5.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.module_el8.10.0+4250+09238ed4
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.3.module_el8.10.0+4251+b427b8a5
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.3.module_el8.10.0+4250+09238ed4
Patches
Vulnerability mechanics
References
7- github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7dnvdPatchWEB
- github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dacnvdPatchWEB
- github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cfnvdPatchWEB
- github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031nvdPatchWEB
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895nvdExploitMitigationVendor AdvisoryWEB
- github.com/advisories/GHSA-rgw5-rvv9-x895ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-69152ghsaADVISORY
News mentions
0No linked articles in our index yet.