Most recent entries from all

ALSA-2026:52841 — Important: nodejs-nodemon security update

Affected: AlmaLinux:10: nodejs-nodemon

Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1165

CLEANSTART-2026-AE26966 — Security fix for CVE-2026-69152 applied in: argo-workflows 3.6.19-r7, langfuse-worker 3.224.0-r3, langfuse-worker 3.224…

Affected: CleanStart: argo-workflows, CleanStart: langfuse-worker, CleanStart: n8n, CleanStart: npm, CleanStart: pulumi, CleanStart: renovate

CVE-2026-69152 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-343962

fkie_cve-2026-69152

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

GHSA-rgw5-rvv9-x895 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Affected: npm: brace-expansion

### Summary

The `maxLength` mitigation added in `5.0.8` for GHSA-mh99-v99m-4gvg / CVE-2026-14257 is incomplete. It bounds the accumulator where results are *combined*, but not the intermediate arrays that feed it. A ~25 KB input still crashes the Node process with an **uncatchable** out-of-memory error, so `try/catch` around `expand()` does not help.

A second, related path in the same function lets a ~400 KB input block the event loop for over two minutes without ever exceeding the memory bound.

### Details

`maxLength` was enforced in `combine()`, the single place output grows. Two arrays are built *before* `combine()` runs, and neither was bounded.

**1. Comma alternatives accumulate without a running total (memory exhaustion)**

Each alternative in `{a,b,c,...}` is expanded by its own recursive `expand_()` call, so each receives a full, independent `maxLength` allowance. The results were then concatenated into a single `values` array with no cumulative limit:

```js values = [] for (let j = 0; j < n.length; j++) { values.push.apply(values, expand_(n[j], max, maxLength, false)) }

acc = combine(acc, pre, values, max, maxLength, ...) ```

With `A` alternatives, `values` can reach `A * maxLength` characters before `combine()` gets a chance to truncate it. At the default `maxLength` of 4,000,000 and 400 alternatives, that is well past any default heap.

**2. Padded sequences ignore `maxLength` while generating (CPU exhaustion)**

`expandSequence()` was bounded by `max` (…

msrc_CVE-2026-69152 — brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

msrc_CVE-2026-69152

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

RHSA-2026:50079 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation postcss: PostCSS: Information disclosure via crafted sourceMappingURL

RHSA-2026:52841 — Red Hat Security Advisory: nodejs-nodemon security update

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

RLSA-2026:52841 — Important: nodejs-nodemon security update

Affected: Rocky Linux:10: nodejs-nodemon

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-69152

Affected: Ubuntu:18.04:LTS: node-brace-expansion, Ubuntu:20.04:LTS: node-brace-expansion, Ubuntu:22.04:LTS: node-brace-expansion, Ubuntu:24.04:LTS: node-brace-expansion, Ubuntu:26.04:LTS: node-brace-expansion

WID-SEC-W-2026-2725 — Red Hat Enterprise Linux (brace-expansion): Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.