CVE-2026-13149
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk28th percentile — higher than 28% of all known CVEs
Summary
A vulnerability in the brace-expansion library up to version 5.0.6 allows a DoS attack via a crafted string. The expand() function has exponential-time complexity when processing many consecutive non-expanding '{}' brace groups. An attacker can cause significant CPU consumption and event-loop blocking.
Risk Assessment
The organization is at risk of a Denial of Service attack that can make applications using this library unavailable. The max option does not mitigate the vulnerability as it only bounds output size, not recursion work.
Recommendation
Immediately update the brace-expansion library to version 5.0.7 or later. If an update is not possible, restrict access to the expand() function for untrusted input.
Original NVD description (English source)
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.