Vulnerability Description
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
Related Weaknesses (CWE)
References
- https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c11672084
- https://www.npmjs.com/package/brace-expansion
FAQ
What is CVE-2026-13149?
CVE-2026-13149 is a documented vulnerability. brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker w...
How severe is CVE-2026-13149?
CVSS scoring is not yet available for CVE-2026-13149. Check NVD for updates.
Is there a patch for CVE-2026-13149?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.