CVE-2026-69152

About vulnerability

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Affected product:

AlmaLinux 9.2 ESU , AngularJS , Babel , Next.js , Node.js , Protocol Buffers , React , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Vue , ai-sdk-harness-pi , angular-animations , angular-pwa , angular-router , apidom , archiver-utils , async-disk-cache , aws-cdk , babel-code-frame , babel-core , babel-eslint-parser , babel-generator , babel-jest , babel-loader , babel-parser , babel-plugin-istanbul , babel-plugin-proposal-class-properties , babel-plugin-proposal-decorators , babel-plugin-proposal-nullish-coalescing-operator , babel-plugin-proposal-numeric-separator , babel-plugin-proposal-optional-chaining , babel-plugin-transform-flow-strip-types , babel-plugin-transform-object-assign , babel-plugin-transform-react-display-name , babel-plugin-transform-react-jsx , babel-preset-react , babel-traverse , babel-types , bin-links , brace-expansion , broccoli , broccoli-babel-transpiler , broccoli-caching-writer , broccoli-clean-css , broccoli-config-loader , broccoli-config-replace , broccoli-filter , broccoli-funnel , broccoli-kitchen-sink-helpers , broccoli-merge-trees , broccoli-persistent-filter , broccoli-plugin , broccoli-sane-watcher , broccoli-sourcemap-concat , broccoli-writer , browser-sync , cacache , cache-loader , cacheable , canvas , cli , commoner , components , config-array , copy-concurrently , cpr , create-jest , create-next-app , css-loader , del , earendil-works-pi-agent-core , earendil-works-pi-ai , editorconfig-core-js , ejs , ember-cli , ember-cli-preprocess-registry , eslint , eslint-community/eslint-utils , eslint-import-resolver-typescript , eslint-plugin-es , eslint-plugin-import , eslint-plugin-jest , eslint-plugin-jest-dom , eslint-plugin-jsx-a11y , eslint-plugin-node , eslint-plugin-react , eslint-plugin-testing-library , eslintrc , extract-css-chunks-webpack-plugin , file-loader , filelist , findup-sync , fork-ts-checker-webpack-plugin , friendly-errors-webpack-plugin , fs-vacuum , fstream , fstream-ignore , fstream-npm , gaze , gentle-fs , gh-pages , glob , globby , gp-js-client , grunt , grunt-karma , hard-source-webpack-plugin , html-webpack-plugin , iarna-cli , ignore-walk , init-package-json , is-git-clean , jake , jasmine-npm , jest , jest-circus , jest-cli , jest-config , jest-core , jest-docblock , jest-environment , jest-environment-jsdom , jest-environment-node , jest-expect , jest-fake-timers , jest-globals , jest-haste-map , jest-jasmine2 , jest-matcher-utils , jest-message-util , jest-mock , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-test-sequencer , jest-transform , jest-util , jest-validate , js-beautify , jscodeshift , karma , karma-jasmine , karma-junit-reporter , karma-requirejs , libcipm , libnpm , libnpmdiff , libnpmexec , libnpmfund , libnpmorg , libnpmversion , lock-verify , loopback , loopback-connector , loopback-connector-remote , loopback-datasource-juggler , loopback-phase , make-fetch-happen , matcher-collection , metro , metro-babel-transformer , metro-cache , metro-config , metro-inspector-proxy , metro-react-native-babel-preset , metro-react-native-babel-transformer , metro-transform-plugins , metro-transform-worker , minimatch , minimizer-webpack-plugin , move-concurrently , move-file , multimatch , nft , nguniversal , nitro , npm , npm-lifecycle , npm-packlist , npm-profile , npm-registry-client , npm-registry-fetch , npm:libnpmpack , npmcli-arborist , npmcli-config , npmcli-map-workspaces , npmcli-metavuln-calculator , npmcli-package-json , nuxt , nuxt-kit , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-webpack-builder , offline-plugin , optimize-css-assets-webpack-plugin , package-json , pacote , pdfjs-dist , pi , plugins , postcss-functions , postcss-loader , postcss-url , progress-bar-webpack-plugin , protractor , puppeteer , puppeteer-core , purgecss , read-installed , read-package-json , read-package-tree , recursive-readdir , regenerator , remix , remix-run-server-runtime , resp-modifier , rewrite , rimraf , rules_nodejs , run-script , rushstack , sane , sass-graph , sb , selenium , sentry-browser , sentry-core , sentry-node , sentry-types , sentry-typescript , shelljs , sigstore-js , sort-package-json , static-config , storybook , storybook-addon-docs , storybook-angular , storybook-builder-webpack5 , storybook-cli , storybook-codemod , storybook-core-webpack , storybook-ember , storybook-html-vite , storybook-nextjs , storybook-preact , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strong-error-handler , strong-globalize , strong-remoting , style-resources-loader , swagger-js , tailwindcss , tempy , test-exclude , testem , thread-loader , time-fix-plugin , tmp , true-case-path , ts-morph , tslint , tslint-consistent-codestyle , tuf-js , typescript-eslint , typescript-eslint-eslint-plugin , typescript-eslint-parser , typescript-eslint-project-service , typescript-eslint-rule-tester , typescript-eslint-scope-manager , typescript-eslint-tsconfig-utils , typescript-eslint-type-utils , typescript-eslint-types , typescript-eslint-typescript-estree , typescript-eslint-visitor-keys , uglifyjs-webpack-plugin , url-loader , vercel-node , vite-plugin-checker , vscode-languageserver-node , webdriver-js-extender , webdriver-manager , webpack , webpack-dev-middleware , webpack-dev-server , webpack-subresource-integrity , webpackbar , wireit , wotan , yam , yaml.js

Affected packages:

brace-expansion @ 2.0.1 (+2847 more)