Copyright © 2012 Red Hat, Inc. All rights reserved.
Important
2026-06-30T08:30:34
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1333
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.
A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.
There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.
Red Hat Hardened Images
2026-06-30T00:00:00Z
RHSA-2026:33866
nodejs26-main-26.4.0-1.3.hum1
Red Hat Hardened Images
2026-07-01T00:00:00Z
RHSA-2026:34478
nodejs24-main-24.18.0-0.2.hum1
Red Hat Hardened Images
2026-07-03T00:00:00Z
RHSA-2026:35272
nodejs22-main-22.23.1-2.hum1
Confidential Compute Attestation
Affected
openshift-sandboxed-containers/osc-pccs
Cryostat 4
Not affected
brace-expansion
Cryostat 4
Not affected
cryostat-openshift-console-plugin-npm
Cryostat 4
Affected
grafana-infinity-datasource-npm
Exploit Intelligence
Affected
exploit-intelligence-tech-preview/vulnerability-analysis-rhel9
Gatekeeper 3
Affected
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Not affected
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Affected
mta/mta-ui-rhel9
Migration Toolkit for Containers
Affected
rhmtc/openshift-migration-ui-rhel8
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Affected
workload-availability/node-healthcheck-rhel9-operator
Node HealthCheck Operator
Affected
workload-availability/node-remediation-console-rhel8
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-agentic-console-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Affected
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Affected
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Service Mesh 2
Will not fix
openshift-service-mesh/kiali-ossmc-rhel8
OpenShift Service Mesh 2
Will not fix
openshift-service-mesh/kiali-rhel8
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Not affected
openshift-service-mesh/kiali-rhel9-operator
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp21/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp22/system
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel7
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel8
Red Hat 3scale API Management Platform 2
Not affected
3scale-amp2/system-rhel9
Red Hat Advanced Cluster Management for Kubernetes 2
Will not fix
rhacm2/volsync-operator-bundle
Red Hat Advanced Cluster Management for Kubernetes 2
Will not fix
rhacm2/volsync-rhel9
Red Hat Advanced Cluster Security 4
Affected
advanced-cluster-security/rhacs-main-rhel8
Red Hat Advanced Cluster Security 4
Affected
advanced-cluster-security/rhacs-main-rhel9
Red Hat AMQ Broker 7
Affected
brace-expansion
Red Hat Ansible Automation Platform 2
Will not fix
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Affected
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Affected
automation-eda-controller
Red Hat build of Apache Camel for Spring Boot 4
Not affected
brace-expansion
Red Hat build of Apache Camel - HawtIO 4
Affected
brace-expansion
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel8
Red Hat build of Apicurio Registry 3
Affected
apicurio/apicurio-registry-ui-rhel9
Red Hat Build of Keycloak
Affected
brace-expansion
Red Hat Build of Podman Desktop
Affected
rh-podman-desktop.git
Red Hat Connectivity Link 1
Affected
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Not affected
brace-expansion
Red Hat Developer Hub
Affected
rhdh/rhdh-hub-rhel9
Red Hat Directory Server 11
Affected
redhat-ds:11/389-ds-base
Red Hat Directory Server 12
Affected
redhat-ds:12/389-ds-base
Red Hat Directory Server 13
Affected
389-ds-base
Red Hat Discovery 2
Affected
discovery/discovery-ui-rhel9
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-ocp-rhel10
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-ocp-rhel9
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-rhel10
Red Hat Edge Manager 1
Affected
rhem/flightctl-ui-rhel9
Red Hat Enterprise Linux 10
Affected
nodejs22
Red Hat Enterprise Linux 10
Affected
nodejs24
Red Hat Enterprise Linux 10
Affected
nodejs-nodemon
Red Hat Enterprise Linux 10
Not affected
rust
Red Hat Enterprise Linux 7
Affected
subscription-manager
Red Hat Enterprise Linux 8
Affected
grafana
Red Hat Enterprise Linux 8
Affected
mozjs60
Red Hat Enterprise Linux 8
Affected
nodejs:22/nodejs
Red Hat Enterprise Linux 8
Affected
nodejs:22/nodejs-nodemon
Red Hat Enterprise Linux 8
Affected
nodejs:24/nodejs
Red Hat Enterprise Linux 8
Affected
nodejs:24/nodejs-nodemon
Red Hat Enterprise Linux 8
Not affected
pcs
Red Hat Enterprise Linux 9
Affected
gjs
Red Hat Enterprise Linux 9
Affected
nodejs:22/nodejs
Red Hat Enterprise Linux 9
Affected
nodejs:22/nodejs-nodemon
Red Hat Enterprise Linux 9
Affected
nodejs:24/nodejs
Red Hat Enterprise Linux 9
Affected
nodejs:24/nodejs-nodemon
Red Hat Enterprise Linux 9
Not affected
pcs
Red Hat Enterprise Linux 9
Not affected
rust
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rhelai3/disk-image-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Affected
rust
Red Hat Fuse 7
Will not fix
brace-expansion
Red Hat Hardened Images
Affected
dotnet8.0
Red Hat Hardened Images
Not affected
llvm
Red Hat Hardened Images
Not affected
llvm21
Red Hat Hardened Images
Will not fix
nodejs20
Red Hat Hardened Images
Will not fix
nodejs25
Red Hat Hardened Images
Not affected
rust
Red Hat Hardened Images
Not affected
yarnpkg
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
brace-expansion
Red Hat JBoss Enterprise Application Platform 8
Not affected
brace-expansion
Red Hat JBoss Enterprise Application Platform Expansion Pack
Not affected
brace-expansion
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-dashboard-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-automl-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-autorag-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-eval-hub-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-gen-ai-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-maas-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-mod-arch-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-mod-arch-model-registry-rhel9
Red Hat OpenShift AI (RHOAI)
Affected
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/nmstate-console-plugin-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-console-rhel9
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-monitoring-plugin-rhel8
Red Hat OpenShift Container Platform 4
Affected
openshift4/ose-monitoring-plugin-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/mcg-core-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/ocs-client-console-rhel9
Red Hat Openshift Data Foundation 4
Affected
odf4/odf-console-rhel9
Red Hat Openshift Data Foundation 4
Not affected
odf4/odf-multicluster-console-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/dashboard-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/jetbrains-ide-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Affected
devspaces/pluginregistry-rhel9
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel8
Red Hat OpenShift GitOps
Affected
openshift-gitops-1/argocd-rhel9
Red Hat OpenShift Virtualization 4
Affected
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Affected
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Affected
quay/quay-rhel8
Red Hat Quay 3
Affected
quay/quay-rhel9
Red Hat Satellite 6
Affected
satellite/iop-advisor-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-host-inventory-frontend-rhel9
Red Hat Satellite 6
Affected
satellite/iop-remediations-rhel9
Red Hat Satellite 6
Affected
satellite/iop-vulnerability-frontend-rhel9
Red Hat Single Sign-On 7
Fix deferred
brace-expansion
Red Hat Trusted Profile Analyzer
Affected
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Affected
ansible-automation-platform/automation-portal
Self-service automation portal 2
Affected
ansible-automation-platform/bootc-automation-portal-rhel9
streams for Apache Kafka 2
Not affected
brace-expansion
streams for Apache Kafka 3
Not affected
brace-expansion
https://www.cve.org/CVERecord?id=CVE-2026-13149
https://nvd.nist.gov/vuln/detail/CVE-2026-13149
https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754
https://www.npmjs.com/package/brace-expansion