Security vulnerabilities and automated fixes for cve 2026 13149 issues
3 posts found
A high-severity Denial of Service vulnerability (CVE-2026-13149) was discovered in the brace-expansion npm package, where maliciously crafted input could trigger exponential-time complexity and crash Node.js applications. The fix upgrades brace-expansion from version 5.0.6 to 5.0.9 using npm overrides to ensure all nested dependencies receive the patched version.
CVE-2026-13149 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package caused by exponential-time complexity when processing certain brace patterns. Because `brace-expansion` is a transitive dependency present in many Node.js projects' production dependency trees, an attacker who can influence glob patterns or file path inputs can trigger runaway CPU consumption and crash the service. The fix upgrades the package to patched versions (1.1.16, 2.1.2, or 5.0.7) and p
CVE-2026-13149 is a denial of service vulnerability in the brace-expansion library that allows attackers to craft specially-formatted input strings that trigger exponential-time complexity in the expansion algorithm. This fix upgrades brace-expansion from version 1.1.15 to 1.1.16, eliminating the algorithmic flaw that could freeze applications processing untrusted input patterns.