{"data":{"id":"3ceb4ef7-e59a-4b94-8e89-3073f4de8edd","title":"GHSA-rgw5-rvv9-x895: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","summary":"The brace-expansion library has a denial-of-service vulnerability where a previous security fix (from version 5.0.8) was incomplete. Attackers can send specially crafted input to crash the Node process with an out-of-memory error, or cause it to freeze for over two minutes, because intermediate arrays created during expansion are not properly limited even though the final output is.","solution":"Both intermediate arrays are now bounded as they are built, using the same limits already applied in combine(): values now tracks a running result count and character length while alternatives are appended and stops once either bound is reached, and expandSequence() now accepts maxLength and stops generating once the sequence's own characters reach it. Output is truncated rather than allowed to grow without bound, matching how the existing max limit already behaves.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-rgw5-rvv9-x895","publishedAt":"2026-08-03T16:35:32.000Z","cveId":"CVE-2026-69152","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["brace-expansion@>= 4.0.0, < 5.0.9 (fixed: 5.0.9)","brace-expansion@>= 3.0.0, < 3.0.6 (fixed: 3.0.6)","brace-expansion@>= 2.0.0, < 2.1.4 (fixed: 2.1.4)","brace-expansion@< 1.1.18 (fixed: 1.1.18)"],"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"patchAvailable":true,"disclosureDate":"2026-08-03T16:35:32.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.75,"researchCategory":null,"atlasIds":null}}