CVE-2026-13149
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A vulnerability in brace-expansion up to version 5.0.6 allows a DoS attack by sending a crafted string with many consecutive non-expanding '{}' brace groups. The expand() function has exponential time complexity, causing high CPU consumption and event-loop blocking.
Risk Assessment
An attacker can remotely overload the server or application, causing service unavailability. The max option does not mitigate this, as it only limits output size, not computational complexity.
Recommendation
Immediately update brace-expansion to version 5.0.7 or later, which includes a fix. If an update is not possible, restrict access to the expand() function for untrusted input.
Other vulnerabilities in brace-expansion
See all- CVE-2025-5889Low
A vulnerability was found in the brace-expansion library up to versions 1.1.11, 2.0.1, 3.0.0, and 4.0.0, involving inefficient regular expression complexity in the expand function in index.js. The attack can be launched remotely.
- CVE-2026-69152High
The brace-expansion library prior to versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9 contains a vulnerability where the expand() function does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences. This allows attacker-controlled input to exhaust memory or block the event loop.
- CVE-2026-14257High
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales until the process hits a fatal out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000).
- CVE-2026-45149Medium
The brace-expansion library versions 5.0.0 to before 5.0.6 apply the max option too late, causing excessive memory (~505 MB) and CPU (~800 ms) usage when expanding large numeric ranges. Fixed in version 5.0.6.
Original NVD description (English source)
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.