CVE-2026-13149 describes a denial of service vulnerability in the juliangruber brace-expansion library through version 5.0.6. The vulnerability arises from the expand() function's exponential-time complexity in handling consecutive non-expanding '{}' brace groups. An attacker can exploit this by passing a crafted string to expand(), either directly or indirectly, leading to significant CPU consumption and blocking of the event loop. The max option, which bounds output size, does not mitigate the underlying recursion and CPU usage problem. This vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption).

Successful exploitation results in denial of service by causing excessive CPU consumption and event-loop blocking, potentially degrading or halting application functionality that relies on the brace-expansion library. There is no indication of privilege escalation, data disclosure, or other impacts beyond resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor the vendor's communications for updates and consider limiting or sanitizing input to the expand() function to avoid triggering the vulnerability until a patch is available.