Backport fix for CVE-2026-13149, an unbound recursion
vulnerability in the brace-expansion module vendored by npm.
The upstream TypeScript fix was manually adapted to the
JavaScript version (brace-expansion 2.0.2) shipped in
Node.js 22. Key changes: wrap expand() body in a for-loop
to avoid recursive stack exhaustion on non-expanding {}
groups, defer post-expansion until a brace set is confirmed
to expand (preventing O(2^n) blowup), and compute post
inline for the $ prefix case.
CVE: CVE-2026-13149
Upstream patches:
- c7e33ec13a.patch
Resolves: RHEL-208653
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
265841473c