CVE-2026-13149: juliangruber brace-expansion denial of service in expand function

CVE-2026-13149 · Severity: medium · CVSS 5.3 · Published 2026-06-30

brace-expansion is a widely-used npm library that parses and expands brace patterns (e.g., "a{1,2}b" → ["a1b", "a2b"]). The library's expand() function exhibits exponential-time O(2ⁿ) behavior when processing certain crafted inputs with many consecutive non-expanding brace groups, allowing an attacker to send a small (~90 bytes) request that causes the application to freeze for minutes, effectively denying service to legitimate requests on that process.

Technologies: brace-expansion (npm). Vendors: npm.

Quick answers

Is CVE-2026-13149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-13149 being exploited in the wild.
How severe is CVE-2026-13149?
Medium severity, with a CVSS score of 5.3, published 30 June 2026.
Which products and versions are affected?
brace-expansion (npm) SEMVER:introduced=3.0.0,fixed=5.0.7.
Is there a fix for CVE-2026-13149?
Yes. brace-expansion (npm): upgrade to 5.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13149 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-13149?
Check whether you run brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • brace-expansion (npm): upgrade to 5.0.7 or later
    npm install brace-expansion@5.0.7

Technical details

The vulnerability is an algorithmic complexity issue (CWE-407) in the expand_() function caused by unconditional recursion on the "post" (remaining suffix) portion of input before evaluating early-return branches. For inputs like "a{},{},…{}" with n consecutive non-expanding groups, the function recurses twice at each level over essentially the same work: T(n) = 2·T(n−1), yielding O(2ⁿ) complexity. A ~90-byte input (30 groups) blocks execution for ~2 minutes; slightly longer inputs hang indefinitely. The max option does not mitigate this because it only bounds output-building loops, not the redundant recursive descents. Attack vector is network (via applications accepting user input for glob/brace patterns), requires no privileges or user interaction. Node.js applications running on a single-threaded event loop are particularly vulnerable—one malicious input stalls the entire worker. The fix defers post computation until after early returns and converts the rewrite logic from recursion to iteration, reducing complexity to ~O(n²).

Affected products

  • juliangruber brace-expansion >=3.0.0, <5.0.7; >=2.0.0, <2.1.2; <1.1.16

Identifiers

  • CVE-2026-13149
  • GHSA-3jxr-9vmj-r5cp

Timeline

  • 2026-07-20: disclosed
  • 2026-07-08: patched: Patched versions released: 5.0.7, 2.1.2, 1.1.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.