CVE-2026-13149: Juliangruber Brace-Expansion

High severity, CVSS 7.7. EPSS: 0.4% chance of exploitation in the next 30 days.

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Affected products

• Juliangruber Brace-Expansion: up to and including 5.0.6

Published 2026-06-30. Last modified 2026-07-08.