CVE-2026-69152

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Brace Expansion Library

Publication date: 2026-08-03

Last updated on: 2026-08-05

Assigner: GitHub, Inc.

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-05

Generated

2026-08-24

AI Q&A

2026-08-03

EPSS Evaluated

2026-08-22

NVD

CVE-2026-69152

EUVD

EUVD-2026-52370

Affected Vendors & Products

Vendor	Product	Version / Range
juliangruber	brace-expansion	to 1.1.18 (exc)
juliangruber	brace-expansion	From 2.0.0 (inc) to 2.1.4 (exc)
juliangruber	brace-expansion	From 3.0.0 (inc) to 3.0.6 (exc)
juliangruber	brace-expansion	From 4.0.0 (inc) to 5.0.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

The brace-expansion library generates strings with a common prefix and suffix. Before versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9, the expand() function did not enforce memory limits while creating intermediate arrays or padded sequences. This allowed attackers to input data that could exhaust system memory or block the event loop by triggering excessive memory usage.

Detection Guidance

This vulnerability is in the brace-expansion library versions before 1.1.18, 2.1.4, 3.0.6, and 5.0.9. To detect it, check the installed version of the library using commands like 'npm list brace-expansion' for Node.js or 'pip show brace-expansion' for Python. If the version is below the patched releases, the system is vulnerable.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive memory or freezing the application's event loop. Systems using vulnerable versions of brace-expansion may become unresponsive or crash when processing crafted input.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. Memory exhaustion or event loop blocking may lead to service unavailability, violating availability requirements in both regulations.

Mitigation Strategies

Update the brace-expansion library to versions 1.1.18, 2.1.4, 3.0.6, or 5.0.9 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-69152. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70