The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1641:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1639:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:58819 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network     applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and     efficient, perfect for data-intensive real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification     (CVE-2026-54272)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:57590 advisory.

    Red Hat build of Podman Desktop is a graphical tool for managing containers using Podman. It allows users     to run, manage, and configure containers and container images using a desktop GUI.

    Security Fix(es):

    * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted     JSON Web Encryption (JWE) object (CVE-2026-34986)

    * ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input     (CVE-2026-42338)

    * protobufjs: protobufjs: Denial of Service via crafted JSON descriptors (CVE-2026-45740)

    * ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` (CVE-2026-45736)

    * devalue: devalue: Excessive memory consumption via deserialization of sparse arrays (CVE-2026-42570)

    * tmp: path Traversal via unsanitized prefix/postfix enables directory escape (CVE-2026-44705)

    * form-data: form-data: Form field override via CRLF injection (CVE-2026-12143)

    * webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy     configuration (CVE-2026-9595)

    * ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments (CVE-2026-48779)

    * extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information     disclosure via symlink validation bypass (CVE-2026-56876)

    * fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization     (CVE-2026-13676)

    * brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

    * tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)

    * tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)

    * js-yaml: js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)

    * protobufjs: protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877)

    * grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation (CVE-2026-48068)

    * linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability (CVE-2026-48801)

    * dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)

    * postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)

    * brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation     (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    Bug Fix(es) and Enhancement(s):

    * Release RH Podman Desktop 1.1.2 to RHEL 10.2 Extensions (JIRA:RHEL-238929)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1596:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55603 advisory.

    - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149       (memory exhaustion via deeply chained brace groups). as well as       CVE-2026-14257 (fixed in 5.0.8).
    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
    - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) in npm's bundled tar
    - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion
    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1566:01 advisory.

    * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
      * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5     (CVE-2026-11824)
      * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address     misclassification (CVE-2026-54272)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55601 advisory.

    - deps: update npm/brace-expansion to 2.1.4       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223914 RHEL-223798

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55541 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)
      * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)
      * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF)     and trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:55541 advisory.

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55541 advisory.

    - Fix for CVE-2026-69152
    - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address
    - Fix CVE-2026-13149 (npm/brace-expansion)
    - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar)
    - CVE-2026-42338 ip-address HTML escaping fix.
    - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
    - patch for npm/braces CVE-2026-25547

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55541 advisory.

    Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network     applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and     efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

    Security Fix(es):

    * brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function     (CVE-2026-14257)

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    * ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and     trust-boundary bypass (CVE-2026-69192)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54530 advisory.

    - deps: update npm/brace-expansion to 2.1.4       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152
    - Backport patch: update sqlite to 3.53.4       Fix: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-224135 RHEL-224144
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-193842 RHEL-193874 RHEL-208661
    - Update to version 22.23.1       Resolves: RHEL-176170       Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619     CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-42338
    - Update to version 22.22.2       Resolves: RHEL-154019       Fixes: CVE-2026-1528 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-27135 CVE-2026-1528
    - Patch fix for sqlite CVE-2025-6965       Resolves: RHEL-103835
    - Update to 22.16.0       Fixes: CVE-2025-23166
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223760
    - Resolves: CVE-2022-25883
    - Resolves: CVE-2021-35065
    - Rebase to 2.0.20       Resolves: CVE-2022-3517
    - Resolves CVE-2020-28469
    - Update to 2.0.7 to resolve CVE-2020-28469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54371 advisory.

    - deps: update npm/brace-expansion to 5.9.0       Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152       Resolves: RHEL-223388 RHEL-223907 RHEL-223792
    - Backport patch update sqlite to 3.53.4       Fixes: CVE-2026-11824, CVE-2026-11822       Resolves: RHEL-218252 RHEL-218257
    - Backport patches for various CVEs       Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149       Resolves: RHEL-194176 RHEL-194179 RHEL-208658
    - Rebase npm/brace-expansion to 5.0.9       Fixes: CVE-2026-69152       Resolves: RHEL-223789

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:52841 advisory.

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-52841 advisory.

    [3.1.14-3]
    - Fix CVE-2026-69152 - brace-expansion

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52841 advisory.

    Simple monitor script for use during development of a node.js app.  For use during development of a     node.js based application.  nodemon will watch the files in the directory in which nodemon was started,     and if any files change, nodemon will automatically restart your node application.  nodemon does not     require any changes to your code or method of development. nodemon simply wraps your node application and     keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node,     think of it as replacing the word node on the command line when you run your script.

    Security Fix(es):

    * brace-expansion: brace-expansion: Denial of Service via unbounded intermediate arrays (CVE-2026-69152)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative
    intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the
    event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions
    1.1.18, 2.1.4, 3.0.6, and 5.0.9. (CVE-2026-69152)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative     intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the     event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions     1.1.18, 2.1.4, 3.0.6, and 5.0.9. (CVE-2026-69152)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
339112	MiracleLinux 9 : [security - high] nodejs:24 (AXSA:2026-1641:01)	Nessus	Miracle Linux Local Security Checks	Local	high
339111	MiracleLinux 9 : [security - high] nodejs:22 (AXSA:2026-1639:01)	Nessus	Miracle Linux Local Security Checks	Local	high
339077	RHEL 10 : nodejs24 (RHSA-2026:58819)	Nessus	Red Hat Local Security Checks	Local	high
338414	RHEL 10 : rh-podman-desktop (RHSA-2026:57590)	Nessus	Red Hat Local Security Checks	Local	critical
338358	MiracleLinux 8 : nodejs:22 (AXSA:2026-1596:01)	Nessus	Miracle Linux Local Security Checks	Local	high
337859	Oracle Linux 9 : nodejs:24 (ELSA-2026-55603)	Nessus	Oracle Linux Local Security Checks	Local	high
337728	MiracleLinux 8 : nodejs:24 (AXSA:2026-1566:01)	Nessus	Miracle Linux Local Security Checks	Local	high
337727	Oracle Linux 9 : nodejs:22 (ELSA-2026-55601)	Nessus	Oracle Linux Local Security Checks	Local	high
337647	AlmaLinux 10 : nodejs22 (ALSA-2026:55541)	Nessus	Alma Linux Local Security Checks	Local	high
337636	RockyLinux 10 : nodejs22 (RLSA-2026:55541)	Nessus	Rocky Linux Local Security Checks	Local	high
337334	Oracle Linux 10 : nodejs22 (ELSA-2026-55541)	Nessus	Oracle Linux Local Security Checks	Local	high
335999	RHEL 10 : nodejs22 (RHSA-2026:55541)	Nessus	Red Hat Local Security Checks	Local	high
335749	Oracle Linux 8 : nodejs:22 (ELSA-2026-54530)	Nessus	Oracle Linux Local Security Checks	Local	high
335747	Oracle Linux 8 : nodejs:24 (ELSA-2026-54371)	Nessus	Oracle Linux Local Security Checks	Local	high
334533	RockyLinux 10 : nodejs-nodemon (RLSA-2026:52841)	Nessus	Rocky Linux Local Security Checks	Local	high
334427	Oracle Linux 10 : nodejs-nodemon (ELSA-2026-52841)	Nessus	Oracle Linux Local Security Checks	Local	high
334418	RHEL 10 : nodejs-nodemon (RHSA-2026:52841)	Nessus	Red Hat Local Security Checks	Local	high
445587	SCA: security update for brace-expansion (GHSA-rgw5-rvv9-x895)	Tenable Cloud Security	SCA Checks	Local	high
445587	SCA: security update for brace-expansion (GHSA-rgw5-rvv9-x895)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
331792	Linux Distros Unpatched Vulnerability : CVE-2026-69152	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-69152

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high