Read the docs
TI-2026-11166 Aliases CVE-2026-13149GHSA-3jxr-9vmj-r5cp

Uncontrolled resource consumption in juliangruber brace-expansion

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 46 fixed, 24 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-07
Fix Partial brace-expansion (npm): 5.0.7, 1.1.16, 2.1.2Red Hat: 66 advisoriesRed Hat: 46 fixed, 24 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
juliangruberbrace-expansionup to 5.0.6—No fix listedCNA
—brace-expansion (npm)3.0.0 to before 5.0.75.0.7Patch availableGHSA-3jxr-9vmj-r5cp
—brace-expansion (npm)before 1.1.161.1.16Patch availableGHSA-3jxr-9vmj-r5cp
—brace-expansion (npm)2.0.0 to before 2.1.22.1.2Patch availableGHSA-3jxr-9vmj-r5cp
  • brace-expansion Vendorjuliangruber Affected up to 5.0.6 Fixed in — No fix listed CNA
  • brace-expansion (npm) Vendor— Affected 3.0.0 to before 5.0.7 Fixed in 5.0.7 Patch available GHSA-3jxr-9vmj-r5cp
  • brace-expansion (npm) Vendor— Affected before 1.1.16 Fixed in 1.1.16 Patch available GHSA-3jxr-9vmj-r5cp
  • brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.1.2 Fixed in 2.1.2 Patch available GHSA-3jxr-9vmj-r5cp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:*——juliangruber
  • cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* Versions — — ·juliangruber

Remediation

  • Fix · GHSA-3jxr-9vmj-r5cp brace-expansion (npm) Fixed in 5.0.7 Advisory →
  • Fix · GHSA-3jxr-9vmj-r5cp brace-expansion (npm) Fixed in 1.1.16 Advisory →
  • Fix · GHSA-3jxr-9vmj-r5cp brace-expansion (npm) Fixed in 2.1.2 Advisory →

Red Hat 66 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:70267 Released 2026-09-22 · Red Hat rating Important
    Red Hat Quay 3.14.9
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
Show 63 more Red Hat advisories
  • RHSA-2026:69255 Released 2026-09-21 · Red Hat rating Important
    Red Hat Quay 3.16.6
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:66545 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.6 release and security update
    • Red Hat AMQ Broker 7.13.6
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:63371 Released 2026-09-03 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:63357 Released 2026-09-03 · Red Hat rating Important
    General availability of the satellite/iop-remediations-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
  • RHSA-2026:60025 Released 2026-09-03 · Red Hat rating Important
    OpenShift Container Platform 4.17.57 security and extras update
    • Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ansible-rhel9-operator, registry.redhat.io/openshift4/ose-aws-efs-csi-driver-container-rhel9 +1
  • RHSA-2026:62260 Released 2026-09-01 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.30.0 Release.
    • Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:57013 Released 2026-08-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:56431 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
  • RHSA-2026:56366 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:54395 Released 2026-08-12 · Red Hat rating Important
    Red Hat Quay 3.17.4
    • Red Hat Quay 3.17 registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:51014 Released 2026-08-12 · Red Hat rating Important
    OpenShift Container Platform 4.18.52 security and extras update
    • Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
  • RHSA-2026:51008 Released 2026-08-12 · Red Hat rating Important
    OpenShift Container Platform 4.19.42 security and extras update
    • Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
  • RHSA-2026:53520 Released 2026-08-11 · Red Hat rating Important
    Red Hat Quay 3.10.25
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:53298 Released 2026-08-11 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.1-3.el10_0, nodejs-devel-1:22.23.1-3.el10_0, nodejs-docs-1:22.23.1-3.el10_0 +4
  • RHSA-2026:52990 Released 2026-08-10 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs26-1:26.7.0-1.5.1.hum1@aarch64, nodejs26-1:26.7.0-1.5.1.hum1@src, nodejs26-1:26.7.0-1.5.1.hum1@x86_64 +16
  • RHSA-2026:52968 Released 2026-08-10 · Red Hat rating Important
    Red Hat Quay 3.12.21
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:52768 Released 2026-08-10 · Red Hat rating Important
    Red Hat Developer Hub 1.9.8 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:52399 Released 2026-08-10 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.6.0+24604+449f851b.s390x::nodejs:22 +28
  • RHSA-2026:52394 Released 2026-08-10 · Red Hat rating Important
    nodejs-nodemon security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-nodemon-3.1.14-2.el10_0
  • RHSA-2026:51349 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:51348 Released 2026-08-06 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:51342 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:51199 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-advisor-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-advisor-frontend-rhel9
  • RHSA-2026:51197 Released 2026-08-06 · Red Hat rating Important
    Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-frontend-rhel9
  • RHSA-2026:51196 Released 2026-08-06 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:51162 Released 2026-08-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.2 security update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
  • RHSA-2026:50931 Released 2026-08-05 · Red Hat rating Important
    Red Hat Quay 3.9.25
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50357 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:50300 Released 2026-08-04 · Red Hat rating Important
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.1 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-ui-rhel9
  • RHSA-2026:49642 Released 2026-08-03 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
  • RHSA-2026:47057 Released 2026-08-03 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.aarch64::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.ppc64le::nodejs:24, nodejs-1:24.18.0-3.module+el9.8.0+24537+83ec84e1.s390x::nodejs:24 +25
  • RHSA-2026:47058 Released 2026-08-03 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el9.8.0+24538+3f176d52.s390x::nodejs:22 +28
  • RHSA-2026:48933 Released 2026-07-30 · Red Hat rating Important
    Red Hat Quay 3.15.7
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:48913 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.10.6 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator
  • RHSA-2026:48891 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.11.2 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9
  • RHSA-2026:48872 Released 2026-07-30 · Red Hat rating Important
    RHACS 4.9.10 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-rhel8-operator, registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-rhel8
  • RHSA-2026:48151 Released 2026-07-29 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-grafana-dashboard-rhel9, cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9 +4
  • RHSA-2026:48126 Released 2026-07-29 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 Plugin Catalog GA plugins release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4
  • RHSA-2026:48124 Released 2026-07-29 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.1 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +2
  • RHSA-2026:48033 Released 2026-07-29 · Red Hat rating Important
    nodejs22 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.1-4.el10_2, nodejs-devel-1:22.23.1-4.el10_2, nodejs-docs-1:22.23.1-4.el10_2 +4
  • RHSA-2026:48034 Released 2026-07-29 · Red Hat rating Important
    nodejs24 security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs24-1:24.18.0-3.el10_2, nodejs24-devel-1:24.18.0-3.el10_2, nodejs24-docs-1:24.18.0-3.el10_2 +3
  • RHSA-2026:48032 Released 2026-07-29 · Red Hat rating Important
    nodejs-nodemon security update
    • Red Hat Enterprise Linux AppStream (v. 10) nodejs-nodemon-3.1.14-2.el10_2
  • RHSA-2026:47059 Released 2026-07-28 · Red Hat rating Important
    nodejs:22 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.aarch64::nodejs:22, nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.ppc64le::nodejs:22, nodejs-1:22.23.1-2.module+el8.10.0+24556+e9352af2.s390x::nodejs:22 +28
  • RHSA-2026:47060 Released 2026-07-28 · Red Hat rating Important
    nodejs:24 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.aarch64::nodejs:24, nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.ppc64le::nodejs:24, nodejs-1:24.18.0-2.module+el8.10.0+24562+090c6525.s390x::nodejs:24 +25
  • RHSA-2026:44239 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.22.7 security and extras update
    • Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9, registry.redhat.io/openshift4/ose-ptp-rhel9-operator
  • RHSA-2026:44268 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.21.26 security and extras update
    • Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
  • RHSA-2026:44264 Released 2026-07-28 · Red Hat rating Important
    OpenShift Container Platform 4.20.31 security and extras update
    • Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/nmstate-console-plugin-rhel9
  • RHSA-2026:45360 Released 2026-07-24 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs26-1:26.5.0-1.4.hum1@aarch64, nodejs26-1:26.5.0-1.4.hum1@src, nodejs26-1:26.5.0-1.4.hum1@x86_64 +16
  • RHSA-2026:42815 Released 2026-07-21 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.2 security update
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:35272 Released 2026-07-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images nodejs22-1:22.23.1-2.hum1@aarch64, nodejs22-1:22.23.1-2.hum1@src, nodejs22-1:22.23.1-2.hum1@x86_64 +14
  • RHSA-2026:34478 Released 2026-07-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs24-1:24.18.0-0.2.hum1@aarch64, nodejs24-1:24.18.0-0.2.hum1@src, nodejs24-1:24.18.0-0.2.hum1@x86_64 +16
  • RHSA-2026:33866 Released 2026-06-30 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images nodejs26-1:26.4.0-1.3.hum1@aarch64, nodejs26-1:26.4.0-1.3.hum1@src, nodejs26-1:26.4.0-1.3.hum1@x86_64 +16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Exploit IntelligenceAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Directory Server 11AffectedNo fix planned: Will not fix
Red Hat Directory Server 12AffectedNo fix planned: Will not fix
Red Hat Directory Server 13AffectedNo fix planned: Will not fix
Red Hat Discovery 2AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix yet: Fix deferred
Red Hat Trusted Profile AnalyzerAffectedNo fix yet
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Cryostat 4 on RHEL 9Fixed RHSA-2026:48151
Red Hat AMQ Broker 7.13.6Fixed RHSA-2026:66545
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:48872
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:48891
Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10Fixed RHSA-2026:48913
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:42815, RHSA-2026:51162
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:50357
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:50479
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:50340
Red Hat Developer Hub 1.10Fixed RHSA-2026:48126, RHSA-2026:49642
Red Hat Developer Hub 1.9Fixed RHSA-2026:52768
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:48032, RHSA-2026:48033, RHSA-2026:48034
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:47059, RHSA-2026:47060
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:47057, RHSA-2026:47058
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:52394, RHSA-2026:53298
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:52399
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat Hardened ImagesFixed RHSA-2026:33866, RHSA-2026:34478, RHSA-2026:35272, RHSA-2026:45360, RHSA-2026:52990
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat Migration Toolkit for Applications 8.1Fixed RHSA-2026:50300
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.3Fixed RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:60025
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:51014
Red Hat OpenShift Container Platform 4.19Fixed RHSA-2026:51008
Red Hat OpenShift Container Platform 4.20Fixed RHSA-2026:44264
Red Hat OpenShift Container Platform 4.21Fixed RHSA-2026:44268
Red Hat OpenShift Container Platform 4.22Fixed RHSA-2026:44239
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:48124
Red Hat OpenShift Dev Spaces 3.30Fixed RHSA-2026:62260
Red Hat Openshift Data Foundation 4.18Fixed RHSA-2026:56431
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:56366
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:57013
Red Hat Quay 3.10Fixed RHSA-2026:53520
Red Hat Quay 3.12Fixed RHSA-2026:52968
Red Hat Quay 3.14Fixed RHSA-2026:70267
Red Hat Quay 3.15Fixed RHSA-2026:48933
Red Hat Quay 3.16Fixed RHSA-2026:69255
Red Hat Quay 3.17Fixed RHSA-2026:54395
Red Hat Quay 3.9Fixed RHSA-2026:50931
Red Hat Satellite 6.18Fixed RHSA-2026:51342, RHSA-2026:51348, RHSA-2026:51349, RHSA-2026:63371
Red Hat Satellite 6.19Fixed RHSA-2026:51196, RHSA-2026:51197, RHSA-2026:51199, RHSA-2026:63357
Not affected: 57 products
  • Cryostat 4
  • Cryostat 4 on RHEL 9
  • Gatekeeper 3
  • Migration Toolkit for Applications 8
  • OpenShift Service Mesh 3
  • Red Hat 3scale API Management Platform 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Migration Toolkit 1.8
  • Red Hat Migration Toolkit for Applications 8.1
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.17
  • Red Hat OpenShift Container Platform 4.18
  • Red Hat OpenShift Container Platform 4.19
  • Red Hat OpenShift Container Platform 4.20
  • Red Hat OpenShift Container Platform 4.21
  • Red Hat OpenShift Container Platform 4.22
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Dev Spaces 3.30
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4.18
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.17
  • Red Hat Quay 3.9
  • Red Hat build of Apache Camel for Spring Boot 4
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-13149
  2. 2026-10-03 Alias added: GHSA-3jxr-9vmj-r5cp
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  6. 2026-10-20 Affected versions changed · Red Hat
  7. 2026-10-23 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  8. 2026-10-30 Affected versions changed · Red Hat
  9. 2026-10-31 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  10. 2026-11-05 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 · Red Hat

References

Advisory 1

Other 11

  • TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
  • TI-2025-05315 juliangruber brace-expansion index.js expand redos CVSS 4.0LOW 2.3
  • TI-2021-17956 Insecure random number generation CVSS 3.1CRITICAL 9.1
  • TI-2026-12072 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash CVSS 3.1HIGH 7.5
  • TI-2026-65313 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion CVSS 3.1HIGH 7.5
  • TI-2026-65311 brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences