CVE-2026-13149 is a denial of service vulnerability in the brace-expansion npm package's expand() function. The flaw causes exponential-time complexity when processing consecutive non-expanding brace groups in input strings, resulting in significant CPU consumption and event-loop blocking. This vulnerability can be exploited by an attacker supplying crafted input directly or transitively via minimatch or glob packages. The max option does not mitigate the issue as it limits output size but not recursion work. The vulnerability affects various Red Hat products that include brace-expansion as a transitive dependency. Red Hat has released updated nodejs26 packages containing fixes. No practical mitigation other than upgrading to fixed versions is available.

Exploitation of this vulnerability results in denial of service due to high CPU usage and event-loop blocking, impacting availability of affected systems. There is no impact on confidentiality or integrity. The vulnerability can be triggered remotely if an attacker can supply crafted input to the vulnerable function. The issue affects multiple Red Hat products that include the vulnerable brace-expansion package as a dependency.

Red Hat has released updated nodejs26 packages (version 26.4.0-1.3.hum1) that address this vulnerability. Users should upgrade to these fixed versions when possible. There is no practical workaround or mitigation other than applying the update. The vulnerability is typically introduced via transitive dependencies, so upgrading the affected packages is the recommended remediation.