CVE-2026-13149: Algorithmic Complexity Denial of Service in brace-expansion
Vulnerability ID: CVE-2026-13149
CVSS Score: 7.7
Published: 2026-07-20
CVE-2026-13149 is a highly severe algorithmic complexity vulnerability in the brace-expansion Node.js library prior to version 5.0.7. When parsing consecutive non-expanding brace groups, the library exhibits exponential-time complexity, leading to process-level Denial of Service in single-threaded runtimes.
TL;DR
An algorithmic complexity flaw in brace-expansion prior to version 5.0.7 allows unauthenticated remote attackers to trigger an exponential-time O(2^n) execution path using short, crafted strings, causing complete thread starvation and Denial of Service in Node.js applications.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-407 (Inefficient Algorithmic Complexity)
- Attack Vector: Network (AV:N)
- CVSS v4.0: 7.7 (High)
- EPSS Score: 0.00361
- Impact: Denial of Service (Thread Starvation)
- Exploit Status: Proof of Concept Available
- CISA KEV Status: Not Listed
Affected Systems
- Node.js applications running brace-expansion <= 1.1.15
- Node.js applications running brace-expansion versions 2.0.0 through 2.1.1
- Node.js applications running brace-expansion versions 3.0.0 through 5.0.6
- Downstream packages consuming vulnerable versions of minimatch or glob
-
brace-expansion: < 1.1.16 (Fixed in:
1.1.16) -
brace-expansion: >= 2.0.0 < 2.1.2 (Fixed in:
2.1.2) -
brace-expansion: >= 3.0.0 <= 5.0.6 (Fixed in:
5.0.7)
Code Analysis
Commit: c7e33ec
Fix exponential expansion of non-expanding brace groups in 5.x
Commit: 835d6be
Backport exponential expansion fix to 2.x
Commit: d74e630
Backport exponential expansion fix to 1.x
Exploit Details
- GitHub Security Advisory: Official advisory with detailed reproduction script and vulnerability analysis.
Mitigation Strategies
- Upgrade brace-expansion library to patched versions 1.1.16, 2.1.2, or 5.0.7.
- Implement dependency overrides in package.json to resolve transitive sub-dependencies.
- Deploy input-validation filters to reject consecutive non-expanding brace groups.
- Apply Web Application Firewall (WAF) regex patterns to drop exploitation payloads at the network edge.
Remediation Steps:
- Scan the codebase with 'npm ls brace-expansion' to locate affected instances.
- Add a 'resolutions' or 'overrides' block in your package.json pointing 'brace-expansion' to '^5.0.7' (or appropriate backported versions).
- Run your package manager install command ('npm install' or 'yarn install') to rebuild the dependency tree.
- Verify the application event-loop behavior using the 30-group proof-of-concept payload in a test environment.
References
- GitHub Security Advisory GHSA-3jxr-9vmj-r5cp
- NVD CVE-2026-13149 Record
- CVE.org CVE-2026-13149 Record
- NPM brace-expansion Package Homepage
- Upstream Git Repository
Read the full report for CVE-2026-13149 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (1)
The fact that the
brace-expansionlibrary exhibits exponential-time complexity when parsing consecutive non-expanding brace groups is particularly concerning, as it can lead to complete thread starvation and Denial of Service in Node.js applications. I've worked with similar parsing libraries in the past, and it's surprising to see how a small oversight in the algorithm can have such significant consequences. The provided mitigation strategies, such as upgrading to patched versions and implementing input-validation filters, are crucial in preventing such attacks. Have you considered exploring alternative parsing libraries that might be less prone to algorithmic complexity vulnerabilities, or do you think the fixes implemented in versions 1.1.16, 2.1.2, and 5.0.7 are sufficient to mitigate this risk?