CVE catalog

CVE-2026-45149

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large nume

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.30% · Oct 25, 2026

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-brace-expansionsid2.1.7+~1.1.2-1fixed
Debiannode-brace-expansionforky2.1.7+~1.1.2-1fixed
Debiannode-brace-expansiontrixie2.0.1+~1.1.0-2vulnerable
Debiannode-brace-expansionbookworm2.0.1-2vulnerable
Cpenode-brace-expansionNot reportedNot reportedvulnerable
Cpebrace-expansionNot reported5.0.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-brace-expansionsourcesid2.0.3+~1.1.2-3not yet assignedNot reported[1138576]
Debiannode-brace-expansionsourceforky2.0.3+~1.1.2-3not yet assignedNot reported[1138576]
Debiannode-brace-expansionsourcetrixie(unfixed)not yet assignedNot reported[1138576]
Debiannode-brace-expansionsourcebookworm(unfixed)not yet assignedNot reported[1138576]
Cpebrace-expansioncpeNot reported5.0.6Not reportedNot reportedNot reported

[Debian bug #1138576]

Notes

[trixie] node-brace-expansion: Minor issue [bookworm] node-brace-expansion: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-brace-expansion]Affected
    Details (2)

    • 2.0.1-2 · all · bookworm

      Affected

      nvd · node-brace-expansion · debian · bookworm; nvd · node-brace-expansion · debian · 12

    • 2.0.1-2 · all · bookworm

      Affected

      nvd · node-brace-expansion · debian · bookworm; nvd · node-brace-expansion · debian · 12

[Debian 13 (Trixie)]

  • [node-brace-expansion]Affected
    Details (2)

    • 2.0.1+~1.1.0-2 · all · trixie

      Affected

      nvd · node-brace-expansion · debian · 13

    • 2.0.1+~1.1.0-2 · all · trixie

      Affected

      nvd · node-brace-expansion · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]