What’s Vulnerable › Vulnerabilities

CVE-2026-13149: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

• Severity: high (CVSS 7.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-10-25
• Weakness: CWE-400

Description

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Affected products

• Npm Brace-Expansion: from 3.0.0 before 5.0.7; before 1.1.16; from 2.0.0 before 2.1.2 — fixed in 5.0.7, 1.1.16, 2.1.2
• juliangruber brace-expansion: through 5.0.6

How to fix

Upgrade to a fixed version: Npm Brace-Expansion 5.0.7, 1.1.16, 2.1.2. Check the vendor advisory for mitigations.

References

• https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
• https://www.npmjs.com/package/brace-expansion

Get alerted when CVE-2026-13149 or the next vulnerability affects your stack