brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

🗓️ 24 Jul 2026 16:53:35Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 9 Views

Brace-expansion denial of service occurs when a crafted string triggers exponential time, CPU usage, and event-loop blocking.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie	24 Jul 202615:43	–	ibm
ATTACKERKB	CVE-2026-13149	30 Jun 202608:30	–	attackerkb
Chainguard	CVE-2026-13149 vulnerabilities	21 Jul 202614:17	–	cgr
Circl	CVE-2026-13149	30 Jun 202610:02	–	circl
CVE	CVE-2026-13149	30 Jun 202608:30	–	cve
Cvelist	CVE-2026-13149	30 Jun 202608:30	–	cvelist
Debian CVE	CVE-2026-13149	30 Jun 202608:30	–	debiancve
EUVD	EUVD-2026-40269	20 Jul 202620:51	–	euvd
Github Security Blog	brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups	20 Jul 202620:51	–	github
NVD	CVE-2026-13149	30 Jun 202610:16	–	nvd

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	nodejs26	26.5.0-1.4.hum1	nodejs26-26.5.0-1.4.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	nodejs26	26.5.0-1.4.hum1	nodejs26-26.5.0-1.4.hum1.x86_64.rpm
Red Hat Hardened Images	any	noarch	nodejs26-bin	26.5.0-1.4.hum1	nodejs26-bin-26.5.0-1.4.hum1.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-13149
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-13149
cve	www.cve.org/CVERecord
npmjs	www.npmjs.com/package/brace-expansion

26 Jul 2026 02:38Current

6Medium risk

Vulners AI Score6

CVSS 48.7

EPSS0.00278

SSVC

brace expansion denial of service exponential time complexity crafted input non expanding groups cpu usage event loop blocking unix platform