Skip to content
Fencer Vulns
high 7.5

CVE-2026-69152 json

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

published 2026-08-03 3 mo ago modified 2026-10-23 16 d ago also GHSA-rgw5-rvv9-x895 , EUVD-2026-52370

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

Patch / fix

  • npm brace-expansion 1.1.18, 2.1.4, 3.0.6, 5.0.9
  • juliangruber brace-expansion 1.1.18, 2.1.4, 3.0.6, 5.0.9
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.8-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.8-1.el9ap
  • python3.12-sqlparse ansible automation platform developer 2.5, ansible automation platform 2.5 0.6.0-1.el8ap
  • python3.12-sqlparse ansible automation platform developer 2.5, ansible automation platform 2.5 0.6.0-1.el9ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.60-1.el8ap
  • python3.12-gitpython ansible automation platform 2.5 3.1.60-1.el9ap
  • automation-gateway-server ansible automation platform 2.5 2.5.20260923-1.el8ap
  • automation-gateway-server ansible automation platform 2.5 2.5.20260923-1.el9ap

red hat advisories RHSA-2026:71114RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228RHSA-2026:64817RHSA-2026:62416

  • velociraptor openSUSE Tumbleweed 0.76.7.0.git145.b60ef1146-1.1

opensuse advisories openSUSE-SU-2026:12070-1

  • nodejs24 AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-npm AlmaLinux 10 1:11.16.0-1.24.18.0.5.el10_2
  • nodejs24-libs AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs24-full-i18n AlmaLinux 10 1:24.18.0-5.el10_2
  • nodejs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-npm AlmaLinux 10 1:10.9.8-1.22.23.1.6.el10_2
  • nodejs-libs AlmaLinux 10 1:22.23.1-6.el10_2
  • nodejs-full-i18n AlmaLinux 10 1:22.23.1-6.el10_2

almalinux advisories ALSA-2026:58819ALSA-2026:55541ALSA-2026:55601ALSA-2026:55603ALSA-2026:54530ALSA-2026:54371

  • nodejs Rocky Linux 9 1:22.23.1-3.module+el9.8.0+40280+057606e8
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40264+d9b257bb
  • nodejs-nodemon Rocky Linux 9 3.1.14-2.module+el9.8.0+40280+057606e8
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40165+d075e3f2
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.8.0+40164+8921ab53
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40052+e32ea525
  • nodejs-packaging Rocky Linux 9 2021.06-6.module+el9.7.0+40153+4d595597
  • nodejs Rocky Linux 9 1:24.18.0-6.module+el9.8.0+40281+14cc6568

rocky linux advisories RLSA-2026:55601RLSA-2026:55603RLSA-2026:54371RLSA-2026:54530RLSA-2026:58819RLSA-2026:55541

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-69152 updated cvss 7.5

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

  • Red Hat Cryostat 4 grafana-infinity-datasource-npm 3.7.2_redhat_00002-1 Red Hat Exploit Intelligence exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-nodejs-external-provider-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-agentic-console-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9, openshift-pipelines/pipelines-console-plugin-pf5-rhel9
    +1 more products
    Red Hat AMQ Broker 7 brace-expansion 1.1.13
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Ansible Automation Platform 2 automation-platform-ui, automation-controller 4.5.35-1.el9ap, automation-eda-controller 1.0.11-1.el9ap, ansible-automation-platform-24/lightspeed-rhel8
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat build of Apache Camel - HawtIO 4 brace-expansion 1.1.13 Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9, apicurio/apicurio-registry-gitops-sync-rhel9 Red Hat Build of Podman Desktop rh-podman-desktop.git 1.1.0 Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Directory Server 11 389-ds-base 1.4.3.39-25.module+el8dsrv+24463+e272972e Red Hat Directory Server 12 389-ds-base 2.2.7-16.module+el9dsrv+24460+990bd826 Red Hat Directory Server 13 389-ds-base 3.2.0-5.el10dsrv
    affected: workaround, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Enterprise Linux 8 grafana-pcp, grafana-pcp 6.1.0-1.el10
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Enterprise Linux AI (RHEL AI) 3 rust 1.97.1-1.el10, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Fuse 7 brace-expansion 1.1.13 Red Hat Hardened Images nodejs25 25.9.0-1.5.hum1, nodejs20 20.20.2-1.1.hum1
    affected: workaround, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat JBoss Enterprise Application Platform 8 jboss-eap-runtime-maven-repository.zip, jboss-eap.1-runtime-maven-repository.zip Red Hat OpenShift AI (RHOAI) rhoai/odh-core-bff-rhel9, rhoai/odh-dashboard-operator-rhel9, rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-console-rhel9, openshift5/nmstate-console-plugin-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
show 16 more
  • Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel9
    affected: workaround, no fix available, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Single Sign-On 7 brace-expansion 1.1.13
    affected: workaround, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9
    affected: workaround, no fix available “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Secrets Management Console for Red Hat OpenShift external-secrets-management/console-plugin-rhel9
    affected: workaround, no fix planned “To mitigate this vulnerability, do not pass untrusted input to the expand() function.”
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-14
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:68333
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1787584486
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:59202
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1787584498
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:59204
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security/rhacs-main-rhel8 1787584487
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:59203
  • Red Hat Ansible Automation Platform 2.1 ansible-automation-platform/automation-portal 1787047114
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:56338
  • Red Hat Ansible Automation Platform 2.2 ansible-automation-platform/automation-portal 1787047188, ansible-automation-platform/bootc-automation-portal-rhel9 1788943531
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:56357
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1787229385
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:59159
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260923-1.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260923-1.el9ap
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:71114
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1789666472, ansible-automation-platform-26/lightspeed-rhel9 1787244079
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:71179
  • Red Hat Ansible Automation Platform 2.7 ansible-automation-platform-27/gateway-rhel9 1788918510
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:67279
  • Red Hat Developer Hub 1.9 rhdh/rhdh-hub-rhel9 1789554285
    fixed: vendor fix “To mitigate this vulnerability, do not pass untrusted input to the expand() function.” RHSA-2026:69248

40 more fixed, 68 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm brace-expansion
<1.1.18
>=2.0.0, <2.1.4
>=3.0.0, <3.0.6
>=4.0.0, <5.0.9
1.1.18
2.1.4
3.0.6
5.0.9

Affected products

  • juliangruber brace-expansion

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.