Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop generates all 10 million intermediate elements before the max limit is applied With max=10, the output is correctly limited to 10 items, but the process still allocates ~505 MB and spends ~800ms building the full intermediate array. This vulnerability is fixed in 5.0.6.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-18 | 1 | Disclosure1 |
| 2026-05-30 | 2 | Active Exploitation1Disclosure1 |
| 2026-06-04 | 1 | General1 |
🟠 brace-expansion, Improper Max Option Application, #CVE-2026-45149 (Medium) -DC-Jun2026-191 https://dailycve.com/brace-expansion-improper-max-option-application-cve-2026-45149-medium-dc-jun2026-191/
Post summary
The tweet simply announces CVE-2026-45149, providing minimal technical details but no evidence of exploitation, mitigation, or a proof of concept.
Our CTI team identified a lot of activities targeting juliangruber brace-expansion (CVE-2026-45149) https://vuldb.com/vuln/367380/cti
Post summary
The CTI team reports widespread activity targeting the CVE-2026-45149 brace‑expansion flaw in juliangruber, indicating active exploitation without providing PoC details or a patch.
CVE-2026-45149 Denial of Service via Uncontrolled Memory Allocation in Brace-Expansion Library 5.0.0-5.0.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45149
Post summary
The text announces a DoS vulnerability caused by uncontrolled memory allocation in Brace‑Expansion Library versions 5.0.0‑5.0.5.
🟠 brace-expansion, Denial of Service (DoS), #CVE-2026-45149 (Moderate) https://dailycve.com/brace-expansion-denial-of-service-dos-cve-2026-45149-moderate/
Post summary
The text announces CVE-2026-45149 as a moderate severity DoS vulnerability affecting brace expansion.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | juliangruber | brace-expansion | - | node.js | - |