{"uuid": "734c6ca3-30ea-4949-adb7-2f12ab232774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69152", "type": "seen", "source": "https://gist.github.com/alon710/d80e5d80b7549449b84a63552411d4ec", "content": "# CVE-2026-69152: CVE-2026-69152: Denial of Service via Resource Exhaustion in brace-expansion\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69152\n\n## Summary\nCVE-2026-69152 is a high-severity Denial of Service (DoS) vulnerability in brace-expansion that allows remote, unauthenticated attackers to cause a process crash or infinite thread-blocking condition. The vulnerability stems from a complete mitigation bypass of the security checks implemented for CVE-2026-14257.\n\n## TL;DR\nA resource exhaustion vulnerability in the brace-expansion library permits unauthenticated remote attackers to trigger process termination via heap memory exhaustion or lock the Node.js event loop by supplying crafted nested brace structures.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-770\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5\n- **EPSS Score**: Not available\n- **Impact**: Denial of Service (Availability)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using brace-expansion package\n- **brace-expansion**: < 1.1.18 (Fixed in: `1.1.18`)\n- **brace-expansion**: >= 2.0.0, < 2.1.4 (Fixed in: `2.1.4`)\n- **brace-expansion**: >= 3.0.0, < 3.0.6 (Fixed in: `3.0.6`)\n- **brace-expansion**: >= 4.0.0, < 5.0.9 (Fixed in: `5.0.9`)\n\n## Mitigation\n\n- Limit input length before passing to brace-expansion\n- Sandbox execution within isolated threads or workers\n- Upgrade brace-expansion to patched versions\n\n**Remediation Steps:**\n1. Verify brace-expansion version in package-lock.json\n2. Update dependencies using npm update brace-expansion or yarn upgrade brace-expansion\n3. Incorporate length checks on untrusted inputs before expansion parsing.\n\n## References\n\n- [v1.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031)\n- [v3.x Line Fix Commit](https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d)\n- [v5.x Line Fix Commit A](https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac)\n- [v5.x Line Fix Commit B](https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69152) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-03T17:31:36.975302Z"}