CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max` DoS protection
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
| CWE | CWE-400 |
| Vendor | juliangruber |
| Product | brace-expansion |
| Published | May 29, 2026 |
| Last Updated | Jun 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for juliangruber brace-expansion
Be the first to know when new medium vulnerabilities affecting juliangruber brace-expansion are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
juliangruber / brace-expansion
>= 5.0.0, < 5.0.6