CVE-2026-69152 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-69152](https://avd.aquasec.com/nvd/cve-2026-69152) | `HIGH` | `brace-expansion` | `1.1.15` | `1.1.18, 2.1.4, 3.0.6, 5.0.9` | `2026-08-03T17:16:45.953Z` | `2026-08-04T10:19:08.862184301Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:fe69820efd000f4a6a34af1fc61ad476e8266f14fa8ebde7688564efba67a2df` |
| `public.ecr.aws/lambda/nodejs:22` | `public.ecr.aws/lambda/nodejs@sha256:b451e3ba090866e72ce04b19b27c7e7e577c82e1582277789767ffa78d3fa737` |

---

## Description

> The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.

---

### Remediation Steps
- Update the affected package `brace-expansion` from version `1.1.15` to `1.1.18, 2.1.4, 3.0.6, 5.0.9`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.