PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45149 juliangruber CVE debrief

A vulnerability in the brace-expansion library (versions 5.0.0 to before 5.0.6) allows uncontrolled resource consumption when processing large numeric range patterns. The library's max option, intended to limit output size, is applied too late in the expansion process. When expanding a pattern like {1..10000000}, the library generates all 10 million intermediate elements before enforcing the limit, causing approximately 505 MB of memory allocation and ~800ms of processing time even when max=10 is configured. This represents a denial-of-service vector through resource exhaustion. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has been remediated in version 5.0.6.

Vendor
juliangruber
Product
brace-expansion
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-07-22
Advisory published
2026-05-29
Advisory updated
2026-07-22

Who should care

Developers using brace-expansion with untrusted user input; DevOps teams monitoring for resource exhaustion attacks; security teams assessing supply chain risk in JavaScript/Node.js applications

Technical summary

The brace-expansion library's max option fails to short-circuit large numeric range generation, causing full intermediate array allocation before limit enforcement. Affected versions 5.0.0-5.0.5. Fixed in 5.0.6.

Defensive priority

medium

Recommended defensive actions

  • Upgrade brace-expansion to version 5.0.6 or later
  • Review applications accepting user-supplied brace expansion patterns for potential DoS exposure
  • Implement input validation to restrict range sizes before passing to brace-expansion
  • Monitor for unusual memory consumption in services using brace-expansion with untrusted input

Evidence notes

Vulnerability description and affected version range derived from official CVE record and GitHub Security Advisory. CVSS 3.1 vector confirms network attack vector with low attack complexity. Fix version 5.0.6 confirmed in advisory.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45149 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45149

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45149 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45149

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.