Brace-Expansion (< 1.1.16)

A Denial of Service vulnerability, tracked as CVE-2026-13149, exists in the `brace-expansion` JavaScript library (versions < 1.1.16, >= 2.0.0 < 2.1.2, and >= 3.0.0 < 5.0.7) that allows an attacker to cause exponential time complexity in the `expand()` function via crafted input, leading to a CPU hang and denial of service in Node.js applications.