Denial of Service Vulnerability in Brace Expansion by Julian Gruber

CVE-2026-13149

What is CVE-2026-13149?

The brace-expansion library is susceptible to a denial of service attack due to an issue in the expand() function. This function can experience exponential-time complexity related to the number of consecutive non-expanding '{}' brace groups. An attacker can exploit this vulnerability by supplying a specially crafted string, leading to excessive CPU usage and blocking of the event loop. Notably, the max option intended to limit output size does not alleviate the issue since it only restricts output rather than addressing the underlying recursive workload.

References