CVE-2026-45149— brace-expansion: Large numeric range defeats documented `max` DoS protection
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| juliangruber | brace-expansion | >= 5.0.0, < 5.0.6 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45149
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
brace-expansion: Large numeric range defeats documented `max` DoS protection
Source: CVE Program / CVE List V5
Vulnerability Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
brace-expansion 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
brace-expansion是Julian Gruber个人开发者的一个JavaScript中的Brace扩展。 brace-expansion 5.0.0至5.0.6之前版本存在资源管理错误漏洞，该漏洞源于max选项应用过晚，在展开单个大数值范围时，序列生成循环在应用max限制前生成所有中间元素，可能导致内存分配和性能问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| juliangruber | brace-expansion | >= 5.0.0, < 5.0.6 | - |
II. Public POCs for CVE-2026-45149
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45149
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-45149 (1)
IV. Related Vulnerabilities
Same product: brace-expansion
- CVE-2026-14257
brace-expansion DoS via unbounded expansion length causing a - CVE-2026-13149
juliangruber brace-expansion 资源管理错误漏洞 - CVE-2026-33750
brace-expansion: Zero-step sequence causes process hang and - CVE-2026-25547
Uncontrolled Resource Consumption in @isaacs/brace-expansion - CVE-2025-5889
juliangruber brace-expansion index.js expand redos
Same vendor: juliangruber
- CVE-2026-14257
brace-expansion DoS via unbounded expansion length causing a - CVE-2026-13149
juliangruber brace-expansion 资源管理错误漏洞 - CVE-2026-33750
brace-expansion: Zero-step sequence causes process hang and - CVE-2025-5889
juliangruber brace-expansion index.js expand redos - CVE-2021-41117
Insecure random number generation
Same weakness: CWE-400
- CVE-2026-55685
React Router: Unauthenticated Denial of Service via Ineffici - CVE-2026-66144
Apache Neethi: Remote PolicyReference fetch lacks resource b - CVE-2026-66143
Apache Neethi: Missing global alternative-output budget acro - CVE-2026-66142
Apache Neethi: Uncontrolled recursion in policy processing - CVE-2026-14257
brace-expansion DoS via unbounded expansion length causing a
V. Comments for CVE-2026-45149
No comments yet