The brace-expansion npm library contains a vulnerability (CVE-2026-69152) in its expand() function that fails to enforce maxLength limits when constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the Node.js event loop, effectively causing a denial of service. The vulnerability bypasses the previously issued fix for CVE-2026-14257, indicating an incomplete remediation. Affected versions span multiple major release branches: below 1.1.18, 2.1.4, 3.0.6, and 5.0.9. Fixed versions have been released across all affected branches (1.1.18, 2.1.4, 3.0.6, and 5.0.9). Users of the brace-expansion library should upgrade immediately to one of the patched versions to mitigate the risk.