{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/brace-expansion--3.0.0--5.0.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-13149"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["brace-expansion (\u003c 1.1.16)","brace-expansion (\u003e= 2.0.0 \u003c 2.1.2)","brace-expansion (\u003e= 3.0.0 \u003c 5.0.7)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","javascript","npm","node.js"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA high-severity Denial of Service (DoS) vulnerability, identified as CVE-2026-13149, has been discovered in the \u003ccode\u003ebrace-expansion\u003c/code\u003e JavaScript library, affecting versions prior to 1.1.16, versions from 2.0.0 up to but not including 2.1.2, and versions from 3.0.0 up to but not including 5.0.7. This flaw stems from an exponential-time complexity issue (O(2ⁿ)) within the \u003ccode\u003eexpand()\u003c/code\u003e function when processing strings containing consecutive non-expanding brace groups, such as \u003ccode\u003ea{},{},{},{}...\u003c/code\u003e. An attacker can exploit this by providing a short, specially crafted ASCII input (e.g., ~90 bytes with 30 non-expanding groups), causing the application's CPU to hang for several minutes or even indefinitely. Since Node.js applications often rely on a single-threaded event loop, successful exploitation can lead to a complete denial of service for the affected worker or process, disrupting application availability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious input string containing a series of consecutive non-expanding brace groups (e.g., \u003ccode\u003ea{},{},{},{}...\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThis crafted string is delivered to a vulnerable application that utilizes the \u003ccode\u003ebrace-expansion\u003c/code\u003e library (versions \u0026lt; 1.1.16, \u0026gt;= 2.0.0 \u0026lt; 2.1.2, or \u0026gt;= 3.0.0 \u0026lt; 5.0.7) to process user-controlled input.\u003c/li\u003e\n\u003cli\u003eThe vulnerable application calls the \u003ccode\u003ebrace-expansion.expand()\u003c/code\u003e function, passing the attacker-controlled string as an argument.\u003c/li\u003e\n\u003cli\u003eWithin the \u003ccode\u003eexpand_\u003c/code\u003e internal function of \u003ccode\u003ebrace-expansion\u003c/code\u003e, the \u003ccode\u003epost\u003c/code\u003e variable is unconditionally computed recursively for each non-expanding group, even when it's not immediately used.\u003c/li\u003e\n\u003cli\u003eThis recursive pattern, combined with a rewrite branch, results in an exponential increase in processing time (O(2ⁿ)) as the number of consecutive non-expanding groups in the input string grows.\u003c/li\u003e\n\u003cli\u003eFor relatively small inputs (e.g., 30 non-expanding groups, approximately 90 bytes), the vulnerable process experiences extreme CPU utilization and a prolonged hang (minutes to indefinite).\u003c/li\u003e\n\u003cli\u003eIn single-threaded environments, such as Node.js, this CPU hang leads to the entire application process becoming unresponsive, effectively causing a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAny application that directly or indirectly passes attacker-influenced strings to \u003ccode\u003ebrace-expansion.expand()\u003c/code\u003e is susceptible to a denial of service. The vulnerability primarily impacts Node.js applications, which are single-threaded, allowing a small, maliciously crafted input (e.g., ~90 bytes) to cause a multi-minute or indefinite CPU hang. This effectively stalls the entire worker or process, preventing it from handling legitimate requests and rendering the service unavailable. For example, a 30-group input can block a thread for minutes, while a slightly longer input can cause an indefinite hang.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ebrace-expansion\u003c/code\u003e library to a patched version (\u0026gt;= 5.0.7) immediately to remediate CVE-2026-13149.\u003c/li\u003e\n\u003cli\u003eIf immediate upgrade is not possible, ensure that untrusted input is not passed directly to \u003ccode\u003ebrace-expansion.expand()\u003c/code\u003e or functions that transitively use it (e.g., \u003ccode\u003eminimatch\u003c/code\u003e/\u003ccode\u003eglob\u003c/code\u003e brace patterns).\u003c/li\u003e\n\u003cli\u003eImplement timeouts or run \u003ccode\u003ebrace-expansion\u003c/code\u003e operations within separate worker threads/processes to isolate the impact of potential CPU hangs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T20:53:00Z","date_published":"2026-07-20T20:53:00Z","id":"https://feed.craftedsignal.io/briefs/2026-07-brace-expansion-dos/","summary":"A Denial of Service vulnerability, tracked as CVE-2026-13149, exists in the `brace-expansion` JavaScript library (versions \u003c 1.1.16, \u003e= 2.0.0 \u003c 2.1.2, and \u003e= 3.0.0 \u003c 5.0.7) that allows an attacker to cause exponential time complexity in the `expand()` function via crafted input, leading to a CPU hang and denial of service in Node.js applications.","title":"CVE-2026-13149: brace-expansion Denial of Service Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-brace-expansion-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Brace-Expansion (\u003e= 3.0.0 \u003c 5.0.7)","version":"https://jsonfeed.org/version/1.1"}