Skip to content

Bundled brace-expansion@5.0.7 is vulnerable to CVE-2026-14257 and CVE-2026-69152 (fixed in 5.0.9) #9869

Description

@mghadley

Steps to reproduce

npm pack npm@11.19.0
tar -xzOf npm-11.19.0.tgz package/node_modules/brace-expansion/package.json | grep '"version"'
# "version": "5.0.7"

Chain and range, from the same tarball:

npm → glob@13.0.6 → minimatch@10.2.5 → brace-expansion: "^5.0.5"

Summary

No upstream change is needed. ^5.0.5 already permits 5.0.9, which is the current latest — this is a refresh of the bundled lockfile, not a dependency bump. 5.0.8 was published 2026-07-23, six days before
the 11.19.0 / 12.0.0–12.0.2 releases of 2026-07-29.

There is no downstream mitigation. Because the dependency is bundled, consumers cannot patch it. Both override forms were tested against a real lockfile and left the resolved version unchanged at 5.0.7:

  • "overrides": { "brace-expansion": "^5.0.9" }
  • "overrides": { "npm": { "brace-expansion": "^5.0.9" } }

GCP Artifact Registry scanning flags this as HIGH, failing the scan gate on every image that installs npm globally. Our only workaround is hand-swapping the directory inside
/usr/local/lib/node_modules/npm/.

This was previously reported in #9832 (opened 3 August, since closed), but that report covered only CVE-2026-14257. It did not mention CVE-2026-69152, which requires 5.0.9, nor that the declared range
already permits the fix. Re-raising with the reproduction and chain, since the root cause is the same stale bundled lockfile as #9867.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions