Security vulnerabilities and automated fixes for cve 2026 69152 issues
3 posts found
CVE-2026-69152 is a high-severity denial of service vulnerability in the brace-expansion library that bypasses the previous CVE-2026-14257 mitigation by exploiting unbounded intermediate array allocation. A critical upgrade to brace-expansion 1.1.18, 2.1.4, 3.0.6, and 5.0.9 fixes this vulnerability by tightening input validation and preventing attackers from exhausting memory through maliciously crafted brace expansion patterns.
CVE-2026-69152 exposed a critical Denial of Service vulnerability in the brace-expansion library that bypassed the previous CVE-2026-14257 mitigation through unbounded intermediate arrays. This vulnerability affected multiple versions of brace-expansion used throughout the dependency tree via minimatch, requiring coordinated upgrades across four major version lines (1.1.18, 2.1.4, 3.0.6, and 5.0.9) to eliminate the attack surface.
A high-severity Denial of Service vulnerability (CVE-2026-69152) was discovered in the `brace-expansion` npm package, where crafted input could generate unbounded intermediate arrays that exhaust system memory. This bypasses the earlier CVE-2026-14257 mitigation. The fix upgrades `brace-expansion` from version 1.1.12 (and 2.0.2) to patched versions 1.1.18 across the dependency tree in the `exia-invasion` project.