The brace-expansion library's expand() function fails to apply the maxLength limit when constructing intermediate arrays or padded sequences, enabling an attacker to supply crafted input that causes unbounded memory allocation. This results in excessive resource consumption leading to denial of service by either terminating the process or blocking the event loop. This vulnerability is a bypass of a previous mitigation (CVE-2026-14257). Applications using nodejs-nodemon that pass user-controlled input to this function are vulnerable. Red Hat's advisory (RHSA-2026:50079) covers this issue (CVE-2026-69152) and includes related fixes in Red Hat Hardened Images and associated RPMs.

An attacker able to supply input to the expand() function can cause excessive memory consumption or event loop blocking, resulting in denial of service of the affected node.js application. This can lead to process termination or application unavailability. No confidentiality or integrity impacts are reported.

Red Hat advises not to pass untrusted or user-controlled input to the expand() function to mitigate this vulnerability. The advisory does not list an official patch or updated package at this time. Patch status is not yet confirmed — check the Red Hat advisory RHSA-2026:50079 for current remediation guidance. Users should monitor Red Hat's errata and apply updates once available.