CVE-2026-13149: Algorithmic Complexity Denial of Service in brace-expansion

Vulnerability ID: CVE-2026-13149
CVSS Score: 7.7
Published: 2026-07-20

CVE-2026-13149 is a highly severe algorithmic complexity vulnerability in the brace-expansion Node.js library prior to version 5.0.7. When parsing consecutive non-expanding brace groups, the library exhibits exponential-time complexity, leading to process-level Denial of Service in single-threaded runtimes.

TL;DR

An algorithmic complexity flaw in brace-expansion prior to version 5.0.7 allows unauthenticated remote attackers to trigger an exponential-time O(2^n) execution path using short, crafted strings, causing complete thread starvation and Denial of Service in Node.js applications.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-407 (Inefficient Algorithmic Complexity)
• Attack Vector: Network (AV:N)
• CVSS v4.0: 7.7 (High)
• EPSS Score: 0.00361
• Impact: Denial of Service (Thread Starvation)
• Exploit Status: Proof of Concept Available
• CISA KEV Status: Not Listed

Affected Systems

• Node.js applications running brace-expansion <= 1.1.15
• Node.js applications running brace-expansion versions 2.0.0 through 2.1.1
• Node.js applications running brace-expansion versions 3.0.0 through 5.0.6
• Downstream packages consuming vulnerable versions of minimatch or glob
• brace-expansion: < 1.1.16 (Fixed in: 1.1.16)
• brace-expansion: >= 2.0.0 < 2.1.2 (Fixed in: 2.1.2)
• brace-expansion: >= 3.0.0 <= 5.0.6 (Fixed in: 5.0.7)

Code Analysis

Commit: c7e33ec

Fix exponential expansion of non-expanding brace groups in 5.x

Commit: 835d6be

Backport exponential expansion fix to 2.x

Commit: d74e630

Backport exponential expansion fix to 1.x

Exploit Details

• GitHub Security Advisory: Official advisory with detailed reproduction script and vulnerability analysis.

Mitigation Strategies

• Upgrade brace-expansion library to patched versions 1.1.16, 2.1.2, or 5.0.7.
• Implement dependency overrides in package.json to resolve transitive sub-dependencies.
• Deploy input-validation filters to reject consecutive non-expanding brace groups.
• Apply Web Application Firewall (WAF) regex patterns to drop exploitation payloads at the network edge.

Remediation Steps:

1. Scan the codebase with 'npm ls brace-expansion' to locate affected instances.
2. Add a 'resolutions' or 'overrides' block in your package.json pointing 'brace-expansion' to '^5.0.7' (or appropriate backported versions).
3. Run your package manager install command ('npm install' or 'yarn install') to rebuild the dependency tree.
4. Verify the application event-loop behavior using the 30-group proof-of-concept payload in a test environment.

References

• GitHub Security Advisory GHSA-3jxr-9vmj-r5cp
• NVD CVE-2026-13149 Record
• CVE.org CVE-2026-13149 Record
• NPM brace-expansion Package Homepage
• Upstream Git Repository

Read the full report for CVE-2026-13149 on our website for more details including interactive diagrams and full exploit analysis.