Backport upstream fix for CVE-2026-13149, a ReDoS/exponential
blowup vulnerability in the bundled brace-expansion dependency.
The fix updates brace-expansion from 5.0.6 to 5.0.7 by patching
the compiled JS files (commonjs and esm) under
deps/npm/node_modules/brace-expansion/. The core change defers
expansion of `post` until after early returns and replaces a
recursive call with a loop in `expand_()`, preventing O(2^n)
blowup on inputs like `a{},{},{},{}...` and avoiding stack
exhaustion from long runs of non-expanding `{}` groups.
CVE: CVE-2026-13149
Advisories:
- c7e33ec13a
Upstream patches:
- c7e33ec13a.patch
Resolves: RHEL-208655
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
b152955871