CVE-2026-13149 describes a denial of service vulnerability in the juliangruber brace-expansion library up to version 5.0.6. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups, which can be exploited by an attacker supplying crafted strings to cause significant CPU consumption and block the event loop. The max option, which bounds output size, does not mitigate the underlying recursion and CPU usage. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to cloud services.

An attacker can cause denial of service by triggering high CPU consumption and event-loop blocking in applications using the vulnerable brace-expansion library. This can degrade or halt application responsiveness, impacting availability. There is no indication of privilege escalation, data disclosure, or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted input with the expand() function or implement application-level timeouts or resource limits to mitigate potential denial of service.