Back to overview

CVE-2026-13149

HIGH
7.7
CVSS 4.0
Description
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Metadata

CVE ID
CVE-2026-13149
State
PUBLISHED
Assigner
seal
Reserved
2026-06-24 10:17 UTC
Published
2026-06-30 08:30 UTC
Last updated
2026-06-30 08:30 UTC
Primary CWE
CWE-400
CWE-400 Uncontrolled Resource Consumption
Vendor / Product
juliangruber / brace-expansion
Sources
cve.org  ·  NVD

Severity & Metrics

7.7 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
Affected products (1)
VendorProductPlatformVersions
juliangruber brace-expansion Linux,macOS,Windows 0 ≤ 5.0.6
Weakness (CWE)
CWESourceDescription
CWE-400 cna CWE-400 Uncontrolled Resource Consumption
CWE-407 cna CWE-407 Inefficient Algorithmic Complexity
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
References (2)
Back to overview