High [CVE-2026-13149] Denial of Service due to exponential-time complexity

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups.

An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This can result in a Denial of Service (DoS) for the affected system.

A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-1333.

Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Enterprise Linux 10.0 Extended Update Support; and 48 more.

Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Advanced Cluster Security 4.9; Red Hat Advanced Cluster Security for Kubernetes 4.10; and 44 more.