The brace-expansion npm library contains a vulnerability (CVE-2026-69152) in its expand() function that fails to apply maxLength limits when constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the Node.js event loop, resulting in a Denial of Service condition. The vulnerability effectively bypasses the fix previously implemented for CVE-2026-14257. Affected versions span multiple major branches: below 1.1.18, 2.1.4, 3.0.6, and 5.0.9. Fixes have been released across all affected major versions (1.1.18, 2.1.4, 3.0.6, and 5.0.9). Multiple GitHub commits and a security advisory (GHSA-rgw5-rvv9-x895) document the remediation. Users of the brace-expansion library should upgrade to patched versions immediately to mitigate the risk.