CVE-2026-69152highCWE-400CWE-770

CVE-2026-69152: falha de alta gravidade em juliangruber brace-expansion

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Publicada em

Seguir esta CVE+ Monitorar brace-expansion+ Monitorar brace-expansion

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.6%
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
juliangruber · brace-expansion
CVEs relacionadas — juliangruber brace-expansion

No mesmo produto, das mais perigosas para as menos.

CVE-2026-14257HIGHbrace-expansion DoS via unbounded expansion length causing an out-of-memory process crashEPSS 0.6%CVE-2025-5889LOWjuliangruber brace-expansion index.js expand redosEPSS 0.6%CVE-2026-102278HIGHbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionEPSS 0.5%CVE-2026-102276HIGHbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionEPSS 0.5%CVE-2026-33750MEDIUMbrace-expansion: Zero-step sequence causes process hang and memory exhaustionEPSS 0.4%CVE-2026-102277MEDIUMbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceEPSS 0.4%