CVE-2026-45149 brace-expansion: Large numeric range defeats documented `max` DoS protection
Attackers can cause excessive memory and CPU consumption in the brace-expansion library by triggering large numeric range expansions before the limit is applied.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-45149?
CVE-2026-45149 is a medium-severity denial of service vulnerability in juliangruber brace-expansion, published on 29 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
Weakness: CWE-400
Which versions are affected by CVE-2026-45149?
2 open source packages ship an affected version, including brace-expansion. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
brace-expansion npm | From 5.0.0 | 5.0.6 |
brace-expansion npm | From 5.0.0 | 5.0.6 |
Linux distribution packages (8)
nodejs24 Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-bin Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-devel Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-docs Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-full-i18n Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-libs Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
nodejs24-npm Red Hat:hummingbird:1 | All versions | 0:11.12.1-1.24.15.0.1.hum1 |
nodejs24-npm-bin Red Hat:hummingbird:1 | All versions | 0:24.15.0-1.hum1 |
Products include Juliangruber Brace-Expansion.
How do I fix CVE-2026-45149?
Upgrade brace-expansion to 5.0.6 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45149 being exploited?
There is no known exploitation of CVE-2026-45149 in the wild and no public exploit code.
Other vulnerabilities in juliangruber brace-expansion
- CVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
- CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
- CVE-2026-33750 brace-expansion: Zero-step sequence causes process hang and memory exhaustion
Sources
Also known as CLEANSTART-2026-EQ50316, CLEANSTART-2026-GE92046, CLEANSTART-2026-HT65704, CLEANSTART-2026-ZT84089, CLSA-2026-1791215768, CLSA-2026-1791226577 and 17 more.