DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-69152: CVE-2026-69152: Denial of Service via Resource Exhaustion in brace-expansion

#security #cve #cybersecurity

CVE-2026-69152: Denial of Service via Resource Exhaustion in brace-expansion

Vulnerability ID: CVE-2026-69152
CVSS Score: 7.5
Published: 2026-08-03

CVE-2026-69152 is a high-severity Denial of Service (DoS) vulnerability in brace-expansion that allows remote, unauthenticated attackers to cause a process crash or infinite thread-blocking condition. The vulnerability stems from a complete mitigation bypass of the security checks implemented for CVE-2026-14257.

TL;DR

A resource exhaustion vulnerability in the brace-expansion library permits unauthenticated remote attackers to trigger process termination via heap memory exhaustion or lock the Node.js event loop by supplying crafted nested brace structures.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400, CWE-770
  • Attack Vector: Network
  • CVSS Score: 7.5
  • EPSS Score: Not available
  • Impact: Denial of Service (Availability)
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not listed

Affected Systems

  • Node.js applications using brace-expansion package
  • brace-expansion: < 1.1.18 (Fixed in: 1.1.18)
  • brace-expansion: >= 2.0.0, < 2.1.4 (Fixed in: 2.1.4)
  • brace-expansion: >= 3.0.0, < 3.0.6 (Fixed in: 3.0.6)
  • brace-expansion: >= 4.0.0, < 5.0.9 (Fixed in: 5.0.9)

Code Analysis

Commit: cb4b9e4

v1.x Line (Backport Fix)

Commit: 139d015

v3.x Line (Backport Fix)

Commit: 1e30c93

v5.x Line (Canonical Fixes)

Commit: 688a99e

v5.x Line (Canonical Fixes)

Exploit Details

  • Advisory PoC: Functional reproduction payloads simulating Comma Alternative memory exhaustion and Sequence generation event loop blocking.

Mitigation Strategies

  • Limit input length before passing to brace-expansion
  • Sandbox execution within isolated threads or workers
  • Upgrade brace-expansion to patched versions

Remediation Steps:

  1. Verify brace-expansion version in package-lock.json
  2. Update dependencies using npm update brace-expansion or yarn upgrade brace-expansion
  3. Incorporate length checks on untrusted inputs before expansion parsing.

References

Read the full report for CVE-2026-69152 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)