CVE-2026-45149

What it actually does

CVE-2026-45149 is a denial-of-service vulnerability in the juliangruber brace-expansion library versions 5.0.0 through 5.0.5. The library applies the configured max limit only after generating the full intermediate expansion set for large numeric ranges. As a result, input such as a very large brace range can force the process to allocate hundreds of megabytes of memory and spend significant CPU time building values that are later discarded. In applications that accept attacker-controlled brace expansion patterns, this can cause event-loop blocking, memory pressure, process crashes, degraded service performance, or container restarts. The flaw is fixed in version 5.0.6.

Why it matters to the business

An attacker may be able to degrade or interrupt services that process user-supplied brace expansion patterns, causing slow responses, failed requests, increased infrastructure cost, or outages. The risk is most relevant for web applications, build systems, developer tooling, search/filter functionality, automation platforms, or APIs that pass untrusted input into brace-expansion. Although this issue has a moderate CVSS score and low EPSS, exploitation requires only crafted input if the vulnerable functionality is reachable, so internet-facing or multi-tenant services should prioritize upgrading dependent packages.

How an attack unfolds

An attacker first identifies an application feature that accepts text patterns, glob expressions, file path templates, filters, or automation inputs that are processed by the vulnerable brace-expansion library. The attacker submits a crafted brace expression containing a very large numeric range, such as a range with millions of values. In vulnerable versions, the library generates the entire intermediate range before enforcing the configured max output limit. Even if the application intended to restrict output to a small number of expansions, the vulnerable code consumes substantial memory and CPU during intermediate array construction. Repeated requests can amplify the effect, causing request latency spikes, process memory exhaustion, garbage collection pressure, crashes, or service restarts. No public exploit maturity or KEV listing is currently reported, but the primitive is simple where vulnerable parsing is exposed to untrusted users.

How to fix it

Upgrade the juliangruber brace-expansion package to version 5.0.6 or later. Because fixed_versions was not provided in the input, use package manager resolution checks to confirm that all direct and transitive dependencies resolve to 5.0.6 or newer. Regenerate lockfiles after upgrading and redeploy affected applications. If immediate upgrade is not possible, mitigate by rejecting or tightly constraining user-supplied brace expressions before they reach the library: limit numeric range span, limit input length, disable brace expansion for untrusted input, enforce request body limits, apply rate limits, and isolate processing with memory and CPU limits. Do not rely solely on the library max option in affected versions, because the vulnerable behavior occurs before the max option is enforced.

How to confirm the fix worked

Confirm remediation by inspecting dependency manifests and lockfiles for brace-expansion versions 5.0.0 through 5.0.5 and verifying that runtime deployments use 5.0.6 or later. Run software composition analysis against built artifacts and containers, not only source repositories. Add a regression test that expands a very large numeric range with a low max value and verify that memory and CPU usage remain bounded. For exposed services, send safe, controlled test inputs in a non-production or approved validation environment to ensure oversized brace ranges are rejected or processed without excessive resource consumption. Monitor application metrics after deployment for reduced memory spikes, CPU saturation, garbage collection pressure, request timeouts, and process restarts.

Typical attack path

1. Find an application endpoint, CLI workflow, API field, or service feature that accepts brace/glob-style patterns or templated strings.
2. Submit a crafted large numeric brace range, for example a pattern resembling {1..10000000}.
3. Trigger server-side processing by the vulnerable brace-expansion library version 5.0.0 through 5.0.5.
4. Force the process to allocate a very large intermediate array before the max limit is applied.
5. Repeat or parallelize requests to increase CPU usage, memory pressure, latency, crashes, or service restarts.

How to detect it

To assess possible prior exploitation, review application access logs, API gateway logs, web server logs, WAF logs, request bodies where retained, error logs, APM traces, and worker/container runtime telemetry for requests containing very large brace numeric ranges. Focus on fields or endpoints that accept path patterns, glob expressions, search filters, file templates, automation rules, or user-defined strings. Correlate suspicious payloads with spikes in process memory, CPU, garbage collection pauses, request latency, HTTP 5xx responses, timeout errors, out-of-memory kills, container restarts, Node.js heap errors, and autoscaling events. Because this is a denial-of-service bug rather than a code-execution issue, expected artifacts are resource-exhaustion symptoms and repeated crafted inputs rather than dropped files or persistence mechanisms. No named threat actors or ransomware use are currently reported for this CVE.

• {1..10000000}
• {0..10000000}
• {1..9999999}
• {0000000..9999999}
• RangeError: Invalid array length
• JavaScript heap out of memory
• FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory
• Allocation failed - JavaScript heap out of memory
• OOMKilled
• out of memory
• brace-expansion

What your security team should do

• Inventory all applications, containers, build systems, and services that include juliangruber brace-expansion, including transitive npm dependencies.
• Prioritize remediation for internet-facing, API-accessible, multi-tenant, CI/CD, automation, or file/template-processing services that accept user-controlled patterns.
• Upgrade brace-expansion to 5.0.6 or later and regenerate lockfiles to prevent vulnerable transitive versions from remaining pinned.
• Add input validation to reject very large brace numeric ranges and disable brace expansion for untrusted input where the feature is not required.
• Add rate limiting, timeout controls, and memory limits around endpoints or workers that process pattern expansion.
• Create monitoring and alerting for repeated oversized brace expressions, sudden memory growth, CPU saturation, request timeouts, and process restarts.
• Review recent logs for signs of attempted resource-exhaustion payloads, especially large brace ranges submitted to pattern, glob, path, filter, query, template, or automation fields.