CVE-2026-45149: brace-expansion: Large numeric range defeats documented `max` DoS protection
The max option was being applied too late:
When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array.
Workaround
Ensure the string to be expanded doesn't contain more values than the desired max item count.
Other sources
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/brace-expansionto a version that resolves this vulnerability.Fixed in 5.0.6 - Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 5.0.6 - Configuration
As a workaround, ensure the string to be expanded does not contain more values than the desired `max` item count.
brace-expansion max = Ensure the input string does not contain more values than the desired max item count.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45149?
CVE-2026-45149 has a medium severity due to performance issues when handling large numeric ranges.
How do I fix CVE-2026-45149?
To fix CVE-2026-45149, update the `brace-expansion` package to version 5.0.6 or later.
What component is affected by CVE-2026-45149?
CVE-2026-45149 affects the `brace-expansion` package in versions from 5.0.0 to 5.0.6.
What is the impact of CVE-2026-45149?
The impact of CVE-2026-45149 includes potential excessive memory consumption when generating large sequences.
Is CVE-2026-45149 publicly disclosed?
Yes, CVE-2026-45149 has been publicly disclosed as part of a security advisory.