CVE-2026-13149
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
| CWE | CWE-400 CWE-407 |
| Vendor | juliangruber |
| Product | brace-expansion |
| Published | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for juliangruber brace-expansion
Be the first to know when new unknown vulnerabilities affecting juliangruber brace-expansion are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
juliangruber / brace-expansion
0 ≤ 5.0.6
References
Credits
bnbdr