점검 대응높음KEV 미등록
CVE-2026-13149
juliangruber brace-expansion 취약점
brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.
- 대응 우선순위
- 점검
- CVSS
- 7.7
- EPSS
- 0.35% 백분위 27.5% · 2026.08.03 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.06.30