Steps to reproduce
npm pack npm@11.19.0
tar -xzOf npm-11.19.0.tgz package/node_modules/brace-expansion/package.json | grep '"version"'
# "version": "5.0.7"
Chain and range, from the same tarball:
npm → glob@13.0.6 → minimatch@10.2.5 → brace-expansion: "^5.0.5"
Summary
No upstream change is needed. ^5.0.5 already permits 5.0.9, which is the current latest — this is a refresh of the bundled lockfile, not a dependency bump. 5.0.8 was published 2026-07-23, six days before
the 11.19.0 / 12.0.0–12.0.2 releases of 2026-07-29.
There is no downstream mitigation. Because the dependency is bundled, consumers cannot patch it. Both override forms were tested against a real lockfile and left the resolved version unchanged at 5.0.7:
- "overrides": { "brace-expansion": "^5.0.9" }
- "overrides": { "npm": { "brace-expansion": "^5.0.9" } }
GCP Artifact Registry scanning flags this as HIGH, failing the scan gate on every image that installs npm globally. Our only workaround is hand-swapping the directory inside
/usr/local/lib/node_modules/npm/.
This was previously reported in #9832 (opened 3 August, since closed), but that report covered only CVE-2026-14257. It did not mention CVE-2026-69152, which requires 5.0.9, nor that the declared range
already permits the fix. Re-raising with the reproduction and chain, since the root cause is the same stale bundled lockfile as #9867.
Steps to reproduce
Chain and range, from the same tarball:
Summary
No upstream change is needed. ^5.0.5 already permits 5.0.9, which is the current latest — this is a refresh of the bundled lockfile, not a dependency bump. 5.0.8 was published 2026-07-23, six days before
the 11.19.0 / 12.0.0–12.0.2 releases of 2026-07-29.
There is no downstream mitigation. Because the dependency is bundled, consumers cannot patch it. Both override forms were tested against a real lockfile and left the resolved version unchanged at 5.0.7:
GCP Artifact Registry scanning flags this as HIGH, failing the scan gate on every image that installs npm globally. Our only workaround is hand-swapping the directory inside
/usr/local/lib/node_modules/npm/.
This was previously reported in #9832 (opened 3 August, since closed), but that report covered only CVE-2026-14257. It did not mention CVE-2026-69152, which requires 5.0.9, nor that the declared range
already permits the fix. Re-raising with the reproduction and chain, since the root cause is the same stale bundled lockfile as #9867.