CVE-2026-13149

Aliases:GHSA-3jxr-9vmj-r5cp
Advisory lineage Upstream: 0 Downstream: 7
PUBLISHED
Published: 30 Jun 2026, 08:30
Last modified:08 Jul 2026, 11:38

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.7 HIGH
v4.0 (cve.org)
EPSS Score
0.36% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Jun 2026, 08:30
Published
Vulnerability first disclosed
08 Jul 2026, 11:38
Last Modified
Vulnerability information updated

Description

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

CVSS Metrics

  • v4.0•HIGH•Score: 7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.36%• Percentile: 28%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

  • CWE-407•Inefficient Algorithmic Complexity

    An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Affected Systems

  • juliangruber•brace-expansion

    ≤ 5.0.6

  • Npm•brace-expansion

    ≥ 3.0.0, < 5.0.7 | < 1.1.16 | ≥ 2.0.0, < 2.1.2

References (12)