CVE-2026-13149

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 5.0.7

Description A denial of service issue exists where the expand() function exhibits exponential-time complexity when processing consecutive non-expanding '{}' brace groups. An attacker can provide a crafted string to the expand() function, either directly or transitively, leading to excessive CPU consumption and blocking of the event loop. The max option is ineffective in this scenario because it limits the size of the output rather than the amount of recursion work performed.

Recommendations Update brace-expansion to version 5.0.7 or later.