{"uuid": "edead90d-f2d6-4b63-a122-782beeb98fb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3jxr-9vmj-r5cp", "type": "seen", "source": "https://gist.github.com/alon710/8cb13493a0f92ed662f2d6291bd0d794", "content": "# CVE-2026-13149: CVE-2026-13149: Algorithmic Complexity Denial of Service in brace-expansion\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-13149\n\n## Summary\nCVE-2026-13149 is a highly severe algorithmic complexity vulnerability in the brace-expansion Node.js library prior to version 5.0.7. When parsing consecutive non-expanding brace groups, the library exhibits exponential-time complexity, leading to process-level Denial of Service in single-threaded runtimes.\n\n## TL;DR\nAn algorithmic complexity flaw in brace-expansion prior to version 5.0.7 allows unauthenticated remote attackers to trigger an exponential-time O(2^n) execution path using short, crafted strings, causing complete thread starvation and Denial of Service in Node.js applications.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407 (Inefficient Algorithmic Complexity)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0**: 7.7 (High)\n- **EPSS Score**: 0.00361\n- **Impact**: Denial of Service (Thread Starvation)\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running brace-expansion <= 1.1.15\n- Node.js applications running brace-expansion versions 2.0.0 through 2.1.1\n- Node.js applications running brace-expansion versions 3.0.0 through 5.0.6\n- Downstream packages consuming vulnerable versions of minimatch or glob\n- **brace-expansion**: < 1.1.16 (Fixed in: `1.1.16`)\n- **brace-expansion**: >= 2.0.0 < 2.1.2 (Fixed in: `2.1.2`)\n- **brace-expansion**: >= 3.0.0 <= 5.0.6 (Fixed in: `5.0.7`)\n\n## Mitigation\n\n- Upgrade brace-expansion library to patched versions 1.1.16, 2.1.2, or 5.0.7.\n- Implement dependency overrides in package.json to resolve transitive sub-dependencies.\n- Deploy input-validation filters to reject consecutive non-expanding brace groups.\n- Apply Web Application Firewall (WAF) regex patterns to drop exploitation payloads at the network edge.\n\n**Remediation Steps:**\n1. Scan the codebase with 'npm ls brace-expansion' to locate affected instances.\n2. Add a 'resolutions' or 'overrides' block in your package.json pointing 'brace-expansion' to '^5.0.7' (or appropriate backported versions).\n3. Run your package manager install command ('npm install' or 'yarn install') to rebuild the dependency tree.\n4. Verify the application event-loop behavior using the 30-group proof-of-concept payload in a test environment.\n\n## References\n\n- [GitHub Security Advisory GHSA-3jxr-9vmj-r5cp](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp)\n- [NVD CVE-2026-13149 Record](https://nvd.nist.gov/vuln/detail/CVE-2026-13149)\n- [CVE.org CVE-2026-13149 Record](https://www.cve.org/CVERecord?id=CVE-2026-13149)\n- [NPM brace-expansion Package Homepage](https://www.npmjs.com/package/brace-expansion)\n- [Upstream Git Repository](https://github.com/juliangruber/brace-expansion)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-13149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-20T21:31:31.976012Z"}