Hi,

The following vulnerability was published for node-brace-expansion.

CVE-2026-13149[0]:
| brace-expansion through 5.0.6 is vulnerable to denial of service.
| The expand() function exhibits exponential-time complexity in the
| number of consecutive non-expanding '{}' brace groups. An attacker
| who passes a crafted string to expand(), directly or transitively,
| can cause significant CPU consumption and event-loop blocking. The
| max option does not mitigate this, as it bounds the output size
| rather than the recursion work.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13149
https://www.cve.org/CVERecord?id=CVE-2026-13149
[1] https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore