Junglewise Threat Intelligence

CVE-2026-13149: juliangruber brace-expansion denial of service in expand function

CVE-2026-13149 · Severity: medium · CVSS 5.3 · Published 2026-06-30

Technologies: Juliangruber Brace-Expansion.

Executive brief

brace-expansion is a widely-used npm library that parses and expands brace patterns (e.g., "a{1,2}b" → ["a1b", "a2b"]). The library's expand() function exhibits exponential-time O(2ⁿ) behavior when processing certain crafted inputs with many consecutive non-expanding brace groups, allowing an attacker to send a small (~90 bytes) request that causes the application to freeze for minutes, effectively denying service to legitimate requests on that process.

Technical details

The vulnerability is an algorithmic complexity issue (CWE-407) in the expand_() function caused by unconditional recursion on the "post" (remaining suffix) portion of input before evaluating early-return branches. For inputs like "a{},{},…{}" with n consecutive non-expanding groups, the function recurses twice at each level over essentially the same work: T(n) = 2·T(n−1), yielding O(2ⁿ) complexity. A ~90-byte input (30 groups) blocks execution for ~2 minutes; slightly longer inputs hang indefinitely. The max option does not mitigate this because it only bounds output-building loops, not the redundant recursive descents. Attack vector is network (via applications accepting user input for glob/brace patterns), requires no privileges or user interaction. Node.js applications running on a single-threaded event loop are particularly vulnerable—one malicious input stalls the entire worker. The fix defers post computation until after early returns and converts the rewrite logic from recursion to iteration, reducing complexity to ~O(n²).

Affected products

  • juliangruber brace-expansion >=3.0.0, <5.0.7; >=2.0.0, <2.1.2; <1.1.16

Timeline

  • 2026-07-20: disclosed
  • 2026-07-08: patched: Patched versions released: 5.0.7, 2.1.2, 1.1.16

References