brace-expansion CVE-2026-45149
MEDIUM
GHSA-jxxr-4gwj-5jf2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
The max option was being applied too late:
When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array.
Workaround
Ensure the string to be expanded doesn't contain more values than the desired max item count.
AnalysisAI
{1..10000000}. Despite the caller configuring a max limit, the sequence generation loop constructs the full intermediate array - allocating ~505 MB of heap and blocking the Node.js event loop for ~800ms - before truncation is applied. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Share
External POC / Exploit Code
Leaving vuln.today