CVE-2026-69152: 
JavaScript vulnerability analysis and mitigation

CVE-2026-69152 is a Denial of Service vulnerability in the brace-expansion npm library that bypasses the mitigation introduced for CVE-2026-14257 (GHSA-mh99-v99m-4gvg). The expand() function fails to apply maxLength limits to intermediate arrays built during comma-alternative expansion and padded sequence generation, allowing attacker-controlled input to exhaust process memory or block the Node.js event loop. Affected versions span all major release lines: < 1.1.18, >= 2.0.0 < 2.1.4, >= 3.0.0 < 3.0.6, and >= 4.0.0 < 5.0.9. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Two distinct code paths are vulnerable: (1) In comma-alternative expansion, each alternative in {a,b,c,...} is expanded by an independent recursive expand_() call, each receiving its own full maxLength allowance. Results are concatenated into a single values array with no cumulative limit, allowing A * maxLength characters to accumulate before combine() can truncate — a ~25 KB input with 400 alternatives can crash the Node.js process with an uncatchable out-of-memory error. (2) In padded sequence generation, expandSequence() was bounded only by max (result count) and never consulted maxLength, so a ~400 KB padded input (e.g., {000...0001..100000}) could block the event loop for over two minutes. Both attack vectors require no authentication and are exploitable remotely via any application that passes user-controlled input to expand() or to glob/pattern-matching libraries that use it (GitHub Advisory).

Successful exploitation results in a Denial of Service affecting availability only — there is no confidentiality or integrity impact. The memory-exhaustion variant terminates the Node.js process with a fatal out-of-memory error that cannot be caught with try/catch, making it particularly severe for server-side applications. The event-loop stall variant blocks all request processing for the duration of the computation (potentially minutes), effectively rendering the service unavailable. Any application using brace-expansion directly or transitively through glob or pattern-matching libraries (which are extremely common in the Node.js ecosystem) is at risk (GitHub Advisory).

1. Identify target: Find a web application or service built on Node.js that accepts user-controlled input processed by brace-expansion (directly or via glob libraries such as minimatch, glob, or micromatch) and is running a vulnerable version (< 1.1.18, >= 2.0.0 < 2.1.4, >= 3.0.0 < 3.0.6, or >= 4.0.0 < 5.0.9).
2. Craft memory-exhaustion payload: Construct a ~25 KB input with 400 comma-separated alternatives, each containing a padded sequence: '{' + Array(400).fill('{' + '0'.repeat(50) + '1..100000}').join(',') + '}'. This causes the intermediate values array to grow to 400 * maxLength characters before combine() can truncate it.
3. Craft event-loop stall payload: Alternatively, construct a ~400 KB padded sequence input: '{' + '0'.repeat(400_000) + '1..100000}'. This causes expandSequence() to generate max wide elements, blocking the event loop for over two minutes.
4. Submit payload: Send the crafted input to the target application via any input vector that reaches expand() — HTTP request parameters, file upload names, search queries, or API fields accepting glob patterns.
5. Achieve DoS: The memory-exhaustion variant crashes the Node.js process with a fatal OOM error (unrecoverable, bypasses try/catch); the event-loop stall variant freezes all request processing for the duration, denying service to all users (GitHub Advisory).

• Logs: Node.js process logs showing FATAL ERROR: Ineffective mark-compacts near heap limit Allocation failed - JavaScript heap out of memory followed by Aborted; application logs showing requests with unusually large brace-pattern strings in input fields.
• Network: HTTP requests containing large payloads (25 KB–400 KB) with repeated brace-expansion patterns such as {...{0...01..100000},...} in query parameters, POST bodies, or headers; unusual spikes in request payload size to endpoints that process glob or file path patterns.
• Process: Node.js process unexpectedly terminating (exit code indicating OOM); sustained 100% CPU usage on the Node.js process for extended periods (minutes) without corresponding legitimate load; event loop lag metrics spiking dramatically.
• Application: Service becoming unresponsive or returning 503 errors following receipt of a specific large request; health check failures coinciding with processing of pattern-matching inputs (GitHub Advisory).

Upgrade brace-expansion to the patched versions: 1.1.18, 2.1.4, 3.0.6, or 5.0.9 depending on the version line in use. The fix bounds both intermediate arrays as they are built — tracking a running result count and character length across comma alternatives, and passing maxLength into expandSequence() to stop generation early. If immediate upgrade is not possible, avoid passing untrusted input to expand() or to any glob/pattern-matching library that uses it. As a partial workaround, pass an explicitly small max and maxLength option (e.g., expand(input, { max: 1000, maxLength: 10000 })), but note that a small maxLength alone was insufficient on affected versions due to per-alternative rather than cumulative enforcement. Applications already on version 5.0.8 are still affected and must upgrade to 5.0.9 (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by Alessio Della Libera, CEO & Co-founder at Numyra, who discovered the memory-exhaustion bypass; the sequence-generation issue was found by the maintainer while verifying that report. Red Hat has tracked the issue via their security advisory process (Red Hat CVE). Tenable has published detection plugins for both cloud security and Nessus scanners (Feedly). No significant broader social media or media coverage has been identified at this time.