CVE-2026-13149 — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Description

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Affected products

Vendor	Product	Affected	Fixed
juliangruber	brace-expansion	≤ 5.0.6	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	node-brace-expansion	No fix yet	—
Debian 13	node-brace-expansion	No fix yet	—
Debian 12	node-brace-expansion	No fix yet	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 26.10	node-brace-expansion	No fix yet	—
Ubuntu 26.04 LTS	node-brace-expansion	No fix yet	—
Ubuntu 25.10	node-brace-expansion	No fix yet	—
Ubuntu 24.04 LTS	node-brace-expansion	No fix yet	—
Ubuntu 22.04 LTS	node-brace-expansion	No fix yet	—

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu 20.04 LTS	node-brace-expansion	No fix yet	—
Ubuntu 18.04 LTS	node-brace-expansion	No fix yet	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
RHEL 10	nodejs +5	1:22.23.1-4.el10_2	RHSA-2026:48033
RHEL 10	nodejs-nodemon	3.1.14-2.el10_2	RHSA-2026:48032
RHEL 10	nodejs-npm	1:10.9.8-1.22.23.1.4.el10_2	RHSA-2026:48033
RHEL 10	nodejs24 +4	1:24.18.0-3.el10_2	RHSA-2026:48034
RHEL 10	nodejs24-npm	1:11.16.0-1.24.18.0.3.el10_2	RHSA-2026:48034
RHEL 10	rh-podman-desktop	1.1.2-1.el10_2	RHSA-2026:57590
RHEL 9	nodejs +4	1:22.23.1-2.module+el9.8.0+24538+3f176d52	RHSA-2026:47058, RHSA-2026:47057
RHEL 9	nodejs-nodemon	3.1.14-1.module+el9.8.0+24540+c30b2ffe	RHSA-2026:47058, RHSA-2026:47057
RHEL 9	nodejs-packaging +1	2021.06-6.module+el9.8.0+24156+bb41d456	RHSA-2026:47058, RHSA-2026:47057
RHEL 9	npm	1:10.9.8-1.22.23.1.2.module+el9.8.0+24538+3f176d52	RHSA-2026:47058, RHSA-2026:47057
RHEL 9	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module+el9.8.0+24538+3f176d52	RHSA-2026:47058
RHEL 9	v8-13.6-devel	3:13.6.233.17-1.24.18.0.3.module+el9.8.0+24537+83ec84e1	RHSA-2026:47057
RHEL 8	nodejs +4	1:22.23.1-2.module+el8.10.0+24556+e9352af2	RHSA-2026:47060, RHSA-2026:47059
RHEL 8	nodejs-nodemon	3.1.14-1.module+el8.10.0+24556+e9352af2	RHSA-2026:47060, RHSA-2026:47059
RHEL 8	nodejs-packaging +1	2021.06-6.module+el8.10.0+24500+8eb51621	RHSA-2026:47060, RHSA-2026:47059
RHEL 8	npm	1:10.9.8-1.22.23.1.2.module+el8.10.0+24556+e9352af2	RHSA-2026:47060, RHSA-2026:47059
RHEL 8	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module+el8.10.0+24556+e9352af2	RHSA-2026:47059
RHEL 8	v8-13.6-devel	3:13.6.233.17-1.24.18.0.2.module+el8.10.0+24562+090c6525	RHSA-2026:47060

Show 3 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
RHEL 10.0 EUS	nodejs +5	1:22.23.1-3.el10_0	RHSA-2026:53298
RHEL 10.0 EUS	nodejs-nodemon	3.1.14-2.el10_0	RHSA-2026:52394
RHEL 10.0 EUS	nodejs-npm	1:10.9.8-1.22.23.1.3.el10_0	RHSA-2026:53298
RHEL 9.6 EUS	nodejs +4	1:22.23.1-2.module+el9.6.0+24604+449f851b	RHSA-2026:52399
RHEL 9.6 EUS	nodejs-nodemon	3.1.14-1.module+el9.6.0+24604+449f851b	RHSA-2026:52399
RHEL 9.6 EUS	nodejs-packaging +1	2021.06-4.module+el9.6.0+23473+45664c2d	RHSA-2026:52399
RHEL 9.6 EUS	npm	1:10.9.8-1.22.23.1.2.module+el9.6.0+24604+449f851b	RHSA-2026:52399
RHEL 9.6 EUS	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module+el9.6.0+24604+449f851b	RHSA-2026:52399
Red Hat Hardened Images 1	nodejs22 +6	22.23.1-2.hum1	RHSA-2026:35272
Red Hat Hardened Images 1	nodejs22-npm	10.9.8-1.22.23.1.2.hum1	RHSA-2026:35272
Red Hat Hardened Images 1	nodejs24 +6	24.18.0-0.2.hum1	RHSA-2026:34478
Red Hat Hardened Images 1	nodejs24-npm	11.16.0-1.24.18.0.0.2.hum1	RHSA-2026:34478
Red Hat Hardened Images 1	nodejs26 +6	26.4.0-1.3.hum1	RHSA-2026:52990, RHSA-2026:45360, RHSA-2026:33866
Red Hat Hardened Images 1	nodejs26-npm	11.17.0-1.26.4.0.1.3.hum1	RHSA-2026:52990, RHSA-2026:45360, RHSA-2026:33866
Red Hat Hardened Images 1	v8-13.6-devel	13.6.233.17-1.24.18.0.0.2.hum1	RHSA-2026:34478
Red Hat Hardened Images 1	v8-14.6-devel	14.6.202.34-1.26.4.0.1.3.hum1	RHSA-2026:52990, RHSA-2026:45360, RHSA-2026:33866

AlmaLinux

Errata ↗

Release	Package	Fixed in	Advisory
AlmaLinux 10	nodejs +4	1:22.23.1-4.el10_2	ALSA-2026:48033
AlmaLinux 10	nodejs-nodemon	3.1.14-2.el10_2	ALSA-2026:48032
AlmaLinux 10	nodejs-npm	1:10.9.8-1.22.23.1.4.el10_2	ALSA-2026:48033
AlmaLinux 10	nodejs24 +4	1:24.18.0-3.el10_2	ALSA-2026:48034
AlmaLinux 10	nodejs24-npm	1:11.16.0-1.24.18.0.3.el10_2	ALSA-2026:48034
AlmaLinux 9	nodejs +4	1:22.23.1-2.module_el9.8.0+285+5c3b0251	ALSA-2026:47058, ALSA-2026:47057
AlmaLinux 9	nodejs-nodemon	3.1.14-1.module_el9.8.0+285+5c3b0251	ALSA-2026:47058, ALSA-2026:47057
AlmaLinux 9	nodejs-packaging +1	2021.06-6.module_el9.7.0+209+ecf6523e	ALSA-2026:47058, ALSA-2026:47057
AlmaLinux 9	npm	1:10.9.8-1.22.23.1.2.module_el9.8.0+285+5c3b0251	ALSA-2026:47058, ALSA-2026:47057
AlmaLinux 9	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module_el9.8.0+285+5c3b0251	ALSA-2026:47058
AlmaLinux 9	v8-13.6-devel	3:13.6.233.17-1.24.18.0.3.module_el9.8.0+286+9023ffdb	ALSA-2026:47057
AlmaLinux 8	nodejs +4	1:22.23.1-2.module_el8.10.0+4236+04bc75d9	ALSA-2026:47060, ALSA-2026:47059
AlmaLinux 8	nodejs-nodemon	3.1.14-1.module_el8.10.0+4236+04bc75d9	ALSA-2026:47060, ALSA-2026:47059
AlmaLinux 8	nodejs-packaging +1	2021.06-6.module_el8.10.0+4086+70facd4a	ALSA-2026:47060, ALSA-2026:47059
AlmaLinux 8	npm	1:10.9.8-1.22.23.1.2.module_el8.10.0+4236+04bc75d9	ALSA-2026:47060, ALSA-2026:47059
AlmaLinux 8	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module_el8.10.0+4236+04bc75d9	ALSA-2026:47059
AlmaLinux 8	v8-13.6-devel	3:13.6.233.17-1.24.18.0.2.module_el8.10.0+4237+cde4efc3	ALSA-2026:47060

Rocky Linux

Errata ↗

Release	Package	Fixed in	Advisory
Rocky Linux 10	nodejs-nodemon	3.1.14-2.el10_2	RLSA-2026:48032
Rocky Linux 10	nodejs22	1:22.23.1-4.el10_2	RLSA-2026:48033
Rocky Linux 10	nodejs24	1:24.18.0-3.el10_2	RLSA-2026:48034
Rocky Linux 9	nodejs	1:22.23.1-2.module+el9.8.0+40263+faa47049	RLSA-2026:47058, RLSA-2026:47057
Rocky Linux 9	nodejs-nodemon	3.1.14-1.module+el9.8.0+40263+faa47049	RLSA-2026:47058, RLSA-2026:47057
Rocky Linux 9	nodejs-packaging	2021.06-6.module+el9.7.0+40052+e32ea525	RLSA-2026:47058, RLSA-2026:47057
Rocky Linux 8	nodejs-packaging	2021.06-6.module+el8.10.0+40048+6d99f608	RLSA-2026:47060, RLSA-2026:47059

SUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
SLES 15 SP7	golang-github-prometheus-alertmanager	0.28.1-150100.4.34.1	SUSE-SU-2026:3714-1
SLES 15 SP7	golang-github-prometheus-prometheus	3.5.4-150100.4.37.2	SUSE-SU-2026:3714-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
SUSE Multi Linux Manager Tools SLE-15	golang-github-prometheus-alertmanager	0.28.1-150002.4.14.1	SUSE-SU-2026:3713-1
SUSE Multi Linux Manager Tools SLE-15	golang-github-prometheus-prometheus	3.5.4-150002.3.16.1	SUSE-SU-2026:3713-1
SUSE Multi Linux Manager Tools SLE-15	grafana	12.4.5-150002.4.24.1	SUSE-SU-2026:3713-1
SUSE Manager Client Tools 15	golang-github-prometheus-alertmanager	0.28.1-150100.4.34.1	SUSE-SU-2026:3714-1
SUSE Manager Client Tools 15	golang-github-prometheus-prometheus	3.5.4-150000.3.75.1	SUSE-SU-2026:3714-1
SUSE Manager Client Tools 15	grafana	12.4.5-150000.1.98.1	SUSE-SU-2026:3714-1

openSUSE

Security tracker ↗

Release	Package	Fixed in	Advisory
openSUSE Tumbleweed	agama-integration-tests	1785848065.5562c7c-4.1	openSUSE-SU-2026:11452-1
openSUSE Tumbleweed	agama-web-ui	24+0.a836cced5-52.1	openSUSE-SU-2026:11680-1
openSUSE Tumbleweed	python-pytest-html	4.2.0-4.1	openSUSE-SU-2026:11220-1
openSUSE Leap 16.0	agama-web-ui	17+673.b97ba64d6-160000.12.1	openSUSE-SU-2026:21448-1
openSUSE Leap 16.0	python-pytest-html	4.1.1-bp160.4.1	openSUSE-SU-2026:21312-1

Amazon Linux

Release	Package	Fixed in	Advisory
Amazon Linux 2023	nodejs22 +4	1:22.23.2-1.amzn2023.0.2	ALAS2023-2026-2060
Amazon Linux 2023	nodejs22-npm	1:10.9.8-1.22.23.2.1.amzn2023.0.2	ALAS2023-2026-2060
Amazon Linux 2023	nodejs24 +4	1:24.18.1-1.amzn2023.0.2	ALAS2023-2026-2059
Amazon Linux 2023	nodejs24-npm	1:11.16.0-1.24.18.1.1.amzn2023.0.2	ALAS2023-2026-2059
Amazon Linux 2023	v8-12.4-devel	3:12.4.254.21-1.22.23.2.1.amzn2023.0.2	ALAS2023-2026-2060
Amazon Linux 2023	v8-13.6-devel	3:13.6.233.17-1.24.18.1.1.amzn2023.0.2	ALAS2023-2026-2059

Oracle Linux

Release	Package	Fixed in	Advisory
Oracle Linux 10	nodejs +4	1:22.23.1-4.el10_2	ELSA-2026-48033
Oracle Linux 10	nodejs-nodemon	3.1.14-2.el10_2	ELSA-2026-48032
Oracle Linux 10	nodejs-npm	1:10.9.8-1.22.23.1.4.el10_2	ELSA-2026-48033
Oracle Linux 10	nodejs24 +4	1:24.18.0-3.0.1.el10_2	ELSA-2026-48034
Oracle Linux 10	nodejs24-npm	1:11.16.0-1.24.18.0.3.0.1.el10_2	ELSA-2026-48034
Oracle Linux 9	nodejs +4	1:22.23.1-2.module+el9.8.0+90973+e42b55e7	ELSA-2026-47058, ELSA-2026-47057
Oracle Linux 9	nodejs-nodemon	3.1.14-1.module+el9.8.0+90973+e42b55e7	ELSA-2026-47058, ELSA-2026-47057
Oracle Linux 9	nodejs-packaging +1	2021.06-6.module+el9.8.0+90946+13dc792a	ELSA-2026-47058, ELSA-2026-47057
Oracle Linux 9	npm	1:10.9.8-1.22.23.1.2.module+el9.8.0+90973+e42b55e7	ELSA-2026-47058, ELSA-2026-47057
Oracle Linux 9	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module+el9.8.0+90973+e42b55e7	ELSA-2026-47058
Oracle Linux 9	v8-13.6-devel	3:13.6.233.17-1.24.18.0.3.module+el9.8.0+90974+83075495	ELSA-2026-47057
Oracle Linux 8	nodejs +4	1:22.23.1-2.module+el8.10.0+90976+97994de0	ELSA-2026-47060, ELSA-2026-47059
Oracle Linux 8	nodejs-nodemon	3.1.14-1.module+el8.10.0+90975+7cc1ae68	ELSA-2026-47060, ELSA-2026-47059
Oracle Linux 8	nodejs-packaging +1	2021.06-4.module+el8.10.0+90968+e271b286	ELSA-2026-47060, ELSA-2026-47059
Oracle Linux 8	npm	1:10.9.8-1.22.23.1.2.module+el8.10.0+90976+97994de0	ELSA-2026-47060, ELSA-2026-47059
Oracle Linux 8	v8-12.4-devel	3:12.4.254.21-1.22.23.1.2.module+el8.10.0+90976+97994de0	ELSA-2026-47059
Oracle Linux 8	v8-13.6-devel	3:13.6.233.17-1.24.18.0.2.module+el8.10.0+90975+7cc1ae68	ELSA-2026-47060

Wolfi

Release	Package	Fixed in	Advisory
Wolfi rolling	argo-workflows-ui-4.0	4.0.11-r0	—
Wolfi rolling	jupyter-base-notebook	7.6.1-r0	—
Wolfi rolling	katib-suggestion-hyperopt	0.19.0-r40	—
Wolfi rolling	langfuse-3-compat	3.225.7-r6	—
Wolfi rolling	langfuse-3-worker	3.224.0-r0	—
Wolfi rolling	lerna	9.0.7-r11	—
Wolfi rolling	nextcloud-server-33	33.0.6-r9	—
Wolfi rolling	opensearch-dashboards-3 +6	3.7.0-r8	—
Wolfi rolling	pnpm-stage0	No fix yet	—
Wolfi rolling	prism	5.16.0-r1	—
Wolfi rolling	pulumi-language-nodejs	3.253.0-r2	—
Wolfi rolling	rancher-api-ui	1.2.3-r10	—
Wolfi rolling	renovate	44.3.3-r4	—
Wolfi rolling	saf	1.6.0-r3	—
Wolfi rolling	serve	14.2.6-r4	—
Wolfi rolling	sqlpad	7.5.7-r29	—
Wolfi rolling	thingsboard-tb-web-ui +1	4.3.1.3-r5	—
Wolfi rolling	ts-patch	4.0.1-r41	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	brace-expansion	>= 3.0.0, < 5.0.7	5.0.7	GHSA-3jxr-9vmj-r5cp
npm	brace-expansion	< 1.1.16	1.1.16	GHSA-3jxr-9vmj-r5cp
npm	brace-expansion	>= 2.0.0, < 2.1.2	2.1.2	GHSA-3jxr-9vmj-r5cp

Advisories 50

WID-SEC-2026-2452 Red Hat Ansible Automation Platform (node-tar, linkify-it, protobufjs, brace-expansion, fast-uri, DOMPurify): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack SUSE / openSUSE Security Updates · Nov 10, 2026
WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
ALSA-2026:47057 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:47058 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:48032 Important: nodejs-nodemon security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:48034 Important: nodejs24 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:48033 Important: nodejs22 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:47059 Important: nodejs:22 security update AlmaLinux Security Advisories · Oct 29, 2026
ALSA-2026:47060 Important: nodejs:24 security update AlmaLinux Security Advisories · Oct 29, 2026
RHSA-2026:57590 Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:53298 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:52990 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:52399 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:52394 Red Hat Security Advisory: nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:48034 Red Hat Security Advisory: nodejs24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:48033 Red Hat Security Advisory: nodejs22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:48032 Red Hat Security Advisory: nodejs-nodemon security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:47059 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:47060 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:47058 Red Hat Security Advisory: nodejs:22 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:47057 Red Hat Security Advisory: nodejs:24 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:45360 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:35272 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:34478 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
RHSA-2026:33866 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
SUSE-SU-2026:3713-1 Security update for Multi-Linux Manager Client Tools - Monitoring stack SUSE / openSUSE Security Updates · Aug 24, 2026
NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
ALAS2023-2026-2059 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 21, 2026
ALAS2023-2026-2060 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 17, 2026
openSUSE-SU-2026:11452-1 agama-integration-tests-1785848065.5562c7c-4.1 on GA media SUSE / openSUSE Security Updates · Aug 6, 2026
ELSA-2026-48034 Important: nodejs24 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 4, 2026
RLSA-2026:47057 Important: nodejs:24 security update Rocky Linux Security Advisories · Aug 3, 2026
RLSA-2026:47058 Important: nodejs:22 security update Rocky Linux Security Advisories · Aug 3, 2026
RLSA-2026:48033 Important: nodejs22 security update Rocky Linux Security Advisories · Jul 31, 2026
RLSA-2026:48034 Important: nodejs24 security update Rocky Linux Security Advisories · Jul 31, 2026
ELSA-2026-47057 Important: nodejs:24 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 31, 2026
RLSA-2026:48032 Important: nodejs-nodemon security update Rocky Linux Security Advisories · Jul 30, 2026
openSUSE-SU-2026:21448-1 Security update for agama-web-ui SUSE / openSUSE Security Updates · Jul 29, 2026
RLSA-2026:47059 Important: nodejs:22 security update Rocky Linux Security Advisories · Jul 29, 2026
ELSA-2026-47060 Important: nodejs:24 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
ELSA-2026-47059 Important: nodejs:22 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
ELSA-2026-48033 Important: nodejs22 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
ELSA-2026-48032 Important: nodejs-nodemon security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
ELSA-2026-47058 Important: nodejs:22 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
RLSA-2026:47060 Important: nodejs:24 security update Rocky Linux Security Advisories · Jul 28, 2026
openSUSE-SU-2026:21312-1 Security update for python-pytest-html SUSE / openSUSE Security Updates · Jul 13, 2026
openSUSE-SU-2026:11220-1 python313-pytest-html-4.2.0-4.1 on GA media SUSE / openSUSE Security Updates · Jul 9, 2026

CNA	v4.0	7.7
EUVD	v4.0	7.7
OSV:GHSA	v3.1	5.3

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

Description

Affected products

Fixed in Linux distributions

Debian

Ubuntu

Red Hat

AlmaLinux

Rocky Linux

SUSE

openSUSE

Amazon Linux

Oracle Linux

Wolfi

Affected packages

Advisories 50

References