High severityNVD Advisory· Published Jun 30, 2026· Updated Jul 8, 2026
CVE-2026-13149
CVE-2026-13149
Description
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
brace-expansionnpm | >= 3.0.0, < 5.0.7 | 5.0.7 |
brace-expansionnpm | < 1.1.16 | 1.1.16 |
brace-expansionnpm | >= 2.0.0, < 2.1.2 | 2.1.2 |
Affected products
138- Range: <=5.0.6
- osv-coords137 versionspkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/azuritepkg:apk/chainguard/foxx-clipkg:apk/chainguard/gitlab-rails-ce-fips-18.11pkg:apk/chainguard/graalvm-25-ce-nodejspkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-8.19pkg:apk/chainguard/kibana-8.19-bitnamipkg:apk/chainguard/kibana-8.19-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.2pkg:apk/chainguard/kibana-9.2-iamguardedpkg:apk/chainguard/kibana-9.3pkg:apk/chainguard/kibana-9.3-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/lernapkg:apk/chainguard/nextcloud-server-31pkg:apk/chainguard/nextcloud-server-32pkg:apk/chainguard/nextcloud-server-33pkg:apk/chainguard/nextcloud-server-34pkg:apk/chainguard/opensearch-dashboards-2pkg:apk/chainguard/opensearch-dashboards-2-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-2-fipspkg:apk/chainguard/opensearch-dashboards-2-fips-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3pkg:apk/chainguard/opensearch-dashboards-3-alerting-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-anomaly-detection-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-dashboards-observabilitypkg:apk/chainguard/opensearch-dashboards-3-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3-fipspkg:apk/chainguard/opensearch-dashboards-3-fips-alerting-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-anomaly-detection-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-mapspkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-notificationspkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-observabilitypkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-query-workbenchpkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-reportingpkg:apk/chainguard/opensearch-dashboards-3-fips-dashboards-search-relevancepkg:apk/chainguard/opensearch-dashboards-3-fips-index-management-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-ml-commons-dashboardspkg:apk/chainguard/opensearch-dashboards-3-fips-security-analytics-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-fips-security-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-index-management-dashboards-pluginpkg:apk/chainguard/opensearch-dashboards-3-security-analytics-dashboards-pluginpkg:apk/chainguard/pelias-apipkg:apk/chainguard/prismpkg:apk/chainguard/pulumi-language-nodejspkg:apk/chainguard/rancher-api-uipkg:apk/chainguard/redisinsightpkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/servepkg:apk/chainguard/sqlpadpkg:apk/chainguard/tensorflow-gpu-jupyterpkg:apk/chainguard/thingsboard-tb-js-executorpkg:apk/chainguard/thingsboard-tb-js-executor-fipspkg:apk/chainguard/thingsboard-tb-web-uipkg:apk/chainguard/thingsboard-tb-web-ui-fipspkg:apk/chainguard/ts-patchpkg:apk/chainguard/unleashpkg:apk/chainguard/unleash-fipspkg:apk/chainguard/unleash-proxypkg:apk/chainguard/wazuh-dashboardpkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-pluginpkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fipspkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-pluginpkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fipspkg:apk/chainguard/wazuh-dashboard-dashboards-mapspkg:apk/chainguard/wazuh-dashboard-dashboards-maps-fipspkg:apk/chainguard/wazuh-dashboard-dashboards-notificationspkg:apk/chainguard/wazuh-dashboard-dashboards-notifications-fipspkg:apk/chainguard/wazuh-dashboard-dashboards-reportingpkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fipspkg:apk/chainguard/wazuh-dashboard-dashboards-visualizationspkg:apk/chainguard/wazuh-dashboard-dashboards-visualizations-fipspkg:apk/chainguard/wazuh-dashboard-fipspkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-pluginpkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fipspkg:apk/chainguard/wazuh-dashboard-pluginspkg:apk/chainguard/wazuh-dashboard-plugins-fipspkg:apk/chainguard/wazuh-dashboard-security-pluginpkg:apk/chainguard/wazuh-dashboard-security-plugin-fipspkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/lernapkg:apk/wolfi/nextcloud-server-31pkg:apk/wolfi/nextcloud-server-32pkg:apk/wolfi/nextcloud-server-33pkg:apk/wolfi/opensearch-dashboards-3pkg:apk/wolfi/opensearch-dashboards-3-alerting-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-anomaly-detection-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-dashboards-observabilitypkg:apk/wolfi/opensearch-dashboards-3-dashboards-reportingpkg:apk/wolfi/opensearch-dashboards-3-index-management-dashboards-pluginpkg:apk/wolfi/opensearch-dashboards-3-security-analytics-dashboards-pluginpkg:apk/wolfi/prismpkg:apk/wolfi/pulumi-language-nodejspkg:apk/wolfi/rancher-api-uipkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/servepkg:apk/wolfi/sqlpadpkg:apk/wolfi/thingsboard-tb-js-executorpkg:apk/wolfi/thingsboard-tb-web-uipkg:apk/wolfi/ts-patchpkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-npmpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/nodejs24pkg:rpm/almalinux/nodejs24-develpkg:rpm/almalinux/nodejs24-docspkg:rpm/almalinux/nodejs24-full-i18npkg:rpm/almalinux/nodejs24-libspkg:rpm/almalinux/nodejs24-npmpkg:rpm/almalinux/npmpkg:rpm/almalinux/v8-12.4-develpkg:rpm/almalinux/v8-13.6-develpkg:rpm/opensuse/agama-integration-tests&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/agama-web-ui&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-pytest-html&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/python-pytest-html&distro=openSUSE%20Tumbleweed
< 3.11.14.4-r16+ 136 more
- (no CPE)range: < 3.11.14.4-r16
- (no CPE)range: < 3.12.9.4-r15
- (no CPE)range: < 2026.2.6-r6
- (no CPE)range: < 2026.5.6-r4
- (no CPE)range: < 2026.5.6-r1
- (no CPE)range: < 3.35.0-r2
- (no CPE)range: < 2.1.1-r9
- (no CPE)range: < 18.11.8-r1
- (no CPE)range: < 25.0.4-r2
- (no CPE)range: < 8.17.10-r30
- (no CPE)range: < 8.17.10-r30
- (no CPE)range: < 8.17.10-r30
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 8.19.18-r3
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.0.8-r34
- (no CPE)range: < 9.2.8-r18
- (no CPE)range: < 9.2.8-r18
- (no CPE)range: < 9.3.8-r1
- (no CPE)range: < 9.3.8-r1
- (no CPE)range: < 9.4.4-r8
- (no CPE)range: < 9.4.4-r8
- (no CPE)range: < 3.224.0-r0
- (no CPE)range: < 3.224.0-r0
- (no CPE)range: < 9.0.7-r12
- (no CPE)range: < 31.0.14-r5
- (no CPE)range: < 32.0.12-r6
- (no CPE)range: < 33.0.6-r9
- (no CPE)range: < 34.0.2-r1
- (no CPE)range: < 2.19.6-r1
- (no CPE)range: < 2.19.6-r10
- (no CPE)range: < 2.19.5-r18
- (no CPE)range: < 2.19.5-r18
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r18
- (no CPE)range: < 3.7.0-r7
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 7.8.0-r7
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 1.2.3-r10
- (no CPE)range: < 3.8.0-r1
- (no CPE)range: < 44.3.3-r4
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 14.2.6-r4
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 0
- (no CPE)range: < 4.3.1.3-r5
- (no CPE)range: < 4.3.1.3-r3
- (no CPE)range: < 4.3.1.3-r5
- (no CPE)range: < 4.3.1.3-r3
- (no CPE)range: < 4.0.1-r41
- (no CPE)range: < 8.0.3-r1
- (no CPE)range: < 8.0.3-r3
- (no CPE)range: < 1.4.19-r1
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.6-r6
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 4.14.7-r1
- (no CPE)range: < 3.224.0-r0
- (no CPE)range: < 9.0.7-r12
- (no CPE)range: < 31.0.14-r5
- (no CPE)range: < 32.0.12-r6
- (no CPE)range: < 33.0.6-r9
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 3.7.0-r8
- (no CPE)range: < 5.16.0-r1
- (no CPE)range: < 3.253.0-r2
- (no CPE)range: < 1.2.3-r10
- (no CPE)range: < 44.3.3-r4
- (no CPE)range: < 1.6.0-r3
- (no CPE)range: < 14.2.6-r4
- (no CPE)range: < 7.5.7-r29
- (no CPE)range: < 4.3.1.3-r5
- (no CPE)range: < 4.3.1.3-r5
- (no CPE)range: < 4.0.1-r41
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:24.18.0-3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3.1.14-2.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1:10.9.8-1.22.23.1.4.el10_2
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 2021.06-6.module_el9.7.0+209+ecf6523e
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:24.18.0-3.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.el10_2
- (no CPE)range: < 1:11.16.0-1.24.18.0.3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251
- (no CPE)range: < 3:13.6.233.17-1.24.18.0.3.module_el9.8.0+286+9023ffdb
- (no CPE)range: < 1785848065.5562c7c-4.1
- (no CPE)range: < 17+673.b97ba64d6-160000.12.1
- (no CPE)range: < 4.1.1-bp160.4.1
- (no CPE)range: < 4.2.0-4.1
Patches
Vulnerability mechanics
References
12- github.com/advisories/GHSA-3jxr-9vmj-r5cpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-13149ghsaADVISORY
- github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265ghsaWEB
- github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754nvdWEB
- github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95ghsaWEB
- github.com/juliangruber/brace-expansion/pull/122ghsaWEB
- github.com/juliangruber/brace-expansion/pull/123ghsaWEB
- github.com/juliangruber/brace-expansion/releases/tag/v1.1.16ghsaWEB
- github.com/juliangruber/brace-expansion/releases/tag/v2.1.2ghsaWEB
- github.com/juliangruber/brace-expansion/releases/tag/v5.0.7ghsaWEB
- github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cpghsaWEB
- www.npmjs.com/package/brace-expansionnvdWEB
News mentions
0No linked articles in our index yet.