PT-2026-67449 · Npm · Brace-Expansion
CVE-2026-69152
·
Published
2026-08-03
·
Updated
2026-08-03
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
brace-expansion versions prior to 1.1.18
brace-expansion versions prior to 2.1.4
brace-expansion versions prior to 3.0.6
brace-expansion versions prior to 5.0.9
Description
An issue exists where the
expand() function fails to properly apply the maxLength limit when constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to cause memory exhaustion, leading to an uncatchable out-of-memory error that crashes the Node process, or to block the event loop, causing a denial of service. The memory exhaustion occurs because alternatives in a brace expansion are expanded independently, allowing the cumulative size of the results to exceed the heap limit before truncation occurs. Additionally, padded sequences ignore the maxLength limit during generation, resulting in excessive CPU usage proportional to the sequence width and count.Recommendations
Update brace-expansion to version 1.1.18 or later.
Update brace-expansion to version 2.1.4 or later.
Update brace-expansion to version 3.0.6 or later.
Update brace-expansion to version 5.0.9 or later.
As a temporary workaround, avoid passing untrusted input to the
expand() function or to glob brace patterns, or provide explicitly small max and maxLength values.Exploit
Fix
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Brace-Expansion