Skip to content
Fencer Intel
medium 6.5

CVE-2026-45149 json

brace-expansion: Large numeric range defeats documented `max` DoS protection

published 5mo ago modified last mo. also EUVD-2026-33442 , GHSA-jxxr-4gwj-5jf2

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.

Patch / fix

  • npm brace-expansion 5.0.6
  • brace_expansion_project brace_expansion 5.0.6
  • juliangruber brace-expansion 5.0.6
  • node-brace-expansion Debian 14 2.0.3+~1.1.2-3

debian advisories DEBIAN-CVE-2026-45149

  • nodejs24 hummingbird 1 24.15.0-1.hum1
  • nodejs24-bin hummingbird 1 24.15.0-1.hum1
  • nodejs24-npm hummingbird 1 11.12.1-1.24.15.0.1.hum1
  • nodejs24-libs hummingbird 1 24.15.0-1.hum1
  • nodejs24-npm-bin hummingbird 1 24.15.0-1.hum1
  • nodejs24-full-i18n hummingbird 1 24.15.0-1.hum1
  • lld hummingbird 1 21.1.8-1.1.hum1
  • lldb hummingbird 1 21.1.8-1.1.hum1

red hat advisories RHSA-2026:13874RHSA-2026:7634RHSA-2026:24069RHSA-2026:22934RHSA-2026:22380RHSA-2026:17682

Is CVE-2026-45149 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45149 updated cvss 6.5

brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs Red Hat Cryostat 4 cryostat-openshift-console-plugin-npm Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-console-plugin-rhel8 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8
    +1 more products
    Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/volsync-operator-bundle, redhat-user-workloads/volsync-tenant/volsync-0-12, redhat-user-workloads/volsync-tenant/volsync-bundle-0-12
    affected: workaround, no fix available “Fix deferred”
  • Red Hat AMQ Broker 7 brace-expansion
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/gateway-rhel9, ansible-automation-platform-27/gateway-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat build of Apicurio Registry 2 brace-expansion Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Keycloak brace-expansion
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Build of Podman Desktop - Tech Preview rhdesktop/rh-podman-desktop-ext-redhat-account-rhel10 Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-rhel10, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-ui-ocp-rhel10 Red Hat Enterprise Linux 8 pcs, rls, rust, cargo, clippy, cockpit, +17 more Red Hat Enterprise Linux 9 gjs, npm, pcs, rust, cargo, clippy, +18 more Red Hat Enterprise Linux 10 nodejs22
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss Enterprise Application Platform Expansion Pack brace-expansion
    affected: workaround, no fix planned “Out of support scope”
show 14 more
  • Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-console-rhel9, openshift4/ose-monitoring-plugin-rhel8, openshift4/ose-monitoring-plugin-rhel9, redhat-user-workloads/ocp-art-tenant/art-images Red Hat Openshift Data Foundation 4 rhceph-dev/odf4-mcg-core-rhel9, rhceph-dev/odf4-odf-console-rhel9, rhceph-dev/odf4-ocs-client-console-rhel9, rhceph-dev/odf4-odf-multicluster-console-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Process Automation 7 brace-expansion
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Satellite 6 satellite/iop-remediations-rhel9, satellite/iop-advisor-frontend-rhel9, satellite/iop-vulnerability-frontend-rhel9, satellite/iop-host-inventory-frontend-rhel9
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Single Sign-On 7 brace-expansion
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Hardened Images rust 1.96.0-1.hum1, llvm 21.1.8-1.1.hum1, llvm21 21.1.8-6.hum1, rustfmt 1.96.0-1.hum1, rust-gdb 1.96.0-1.hum1, rust-src 1.96.0-1.hum1, +55 more
    fixed: vendor fix RHSA-2026:17682
  • Red Hat Openshift Data Foundation 4.22 odf4/cephcsi-rhel9 1787057250, odf4/odf-cli-rhel9 1787058706, odf4/mcg-core-rhel9 1787058450, odf4/odf-drbd-rhel9 1787059538, odf4/odf-console-rhel9 1787059072, odf4/devicefinder-rhel9 1787057603, +22 more
    fixed: vendor fix RHSA-2026:56928
  • Red Hat OpenShift Dev Spaces 3.29 devspaces/code-rhel9 1785245777, devspaces/dashboard-rhel9 1784737150
    fixed: vendor fix RHSA-2026:48124
  • Red Hat OpenShift Dev Spaces 3.30 devspaces/openvsx-rhel9 1787759145, devspaces/pluginregistry-rhel9 1787759723
    fixed: vendor fix RHSA-2026:62260
  • Red Hat OpenShift Service Mesh 3.0 openshift-service-mesh/kiali-rhel9 1787076495, openshift-service-mesh/kiali-ossmc-rhel9 1787077028
    fixed: vendor fix RHSA-2026:59548
  • Red Hat OpenShift Service Mesh 3.1 openshift-service-mesh/kiali-rhel9 1787092198, openshift-service-mesh/kiali-ossmc-rhel9 1787075730
    fixed: vendor fix RHSA-2026:59561
  • Red Hat OpenShift Service Mesh 3.2 openshift-service-mesh/kiali-rhel9 1787092255, openshift-service-mesh/kiali-ossmc-rhel9 1787077188
    fixed: vendor fix RHSA-2026:59554
  • Red Hat OpenShift Service Mesh 3.3 openshift-service-mesh/kiali-rhel9 1787077108, openshift-service-mesh/kiali-ossmc-rhel9 1787076322
    fixed: vendor fix RHSA-2026:59566
  • Red Hat Cryostat 4 brace-expansion, grafana-infinity-datasource-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8, mta/mta-ui-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
    not affected: vulnerable code not present

36 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm brace-expansion
>=5.0.0, <5.0.6
5.0.6

Affected products

  • juliangruber brace-expansion

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.