Skip to content
Threat Feed
Subscribe

Product

Brace-Expansion (>= 2.0.0 < 2.1.2)

1 brief RSS
medium advisory

CVE-2026-13149: brace-expansion Denial of Service Vulnerability

A Denial of Service vulnerability, tracked as CVE-2026-13149, exists in the `brace-expansion` JavaScript library (versions < 1.1.16, >= 2.0.0 < 2.1.2, and >= 3.0.0 < 5.0.7) that allows an attacker to cause exponential time complexity in the `expand()` function via crafted input, leading to a CPU hang and denial of service in Node.js applications.

brace-expansion +2 denial-of-service javascript npm node.js
1t 1c