brace-expansion CVE-2026-13149

brace-expansion is a JavaScript library used to expand brace patterns, commonly embedded as a transitive dependency in Node.js applications via glob or minimatch. The vulnerability (CWE-400) stems from an algorithmic flaw in the expand_() function: it recursively expands the post portion of a brace group before checking if the group actually expands, leading to O(2ⁿ) time complexity. For input strings containing many consecutive empty brace groups (e.g., 'a{},{},...{}'), each non-expanding group triggers a recursive call that discards the result, doubling the work. The fix restructures the code to compute post only when needed and converts a recursive rewrite into a loop. Affected products per CPE cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* include all versions prior to 1.1.16, 2.1.2, and 5.0.7.