PT-2026-41726 · Npm · Brace-Expansion

Published 2026-05-18 · Updated 2026-05-18 · CVE-2026-45149

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions brace-expansion (affected versions not specified)

Description A Denial of Service (DoS) issue exists where the max option is applied too late during the expansion of large numeric ranges. For example, expanding a range like {1..10000000} causes the sequence generation loop to create all intermediate elements before applying the limit. This results in excessive memory allocation and processing time, even when a small max value is specified.

Recommendations Ensure the string to be expanded does not contain more values than the desired max item count.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-45149

GHSA-JXXR-4GWJ-5JF2

Affected Products

Brace-Expansion

References · 5

• https://osv.dev/vulnerability/GHSA-jxxr-4gwj-5jf2 · Vendor Advisory
• https://github.com/juliangruber/brace-expansion · Note
• https://twitter.com/dailycve/status/2056432506698637633 · Twitter Post
• https://github.com/juliangruber/brace-expansion/commit/c0b095bdc52bc4c36dc88deddbadabc49f8371e5 · Note
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2 · Note