CVE-2026-13149 (HIGH): detected in Lambda Docker Images.

[the-lambda-watchdog]

CVE Details

CVE ID	Severity	Affected Package	Installed Version	Fixed Version	Date Published	Date of Scan
CVE-2026-13149	HIGH	brace-expansion	1.1.15	5.0.7, 1.1.16, 2.1.2	2026-06-30T10:16:34.56Z	2026-07-22T10:18:15.468343918Z

---

Affected Docker Images

Image Name	SHA
public.ecr.aws/lambda/nodejs:latest	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:24	public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f
public.ecr.aws/lambda/nodejs:22	public.ecr.aws/lambda/nodejs@sha256:7fb30f61a372768a2ee1c1af89340e2b3b69782bc1135b0101669ee1106d1d0c

---

Description

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

---

Remediation Steps

• Update the affected package brace-expansion from version 1.1.15 to 5.0.7, 1.1.16, 2.1.2.

About this issue

• This issue may not contain all the information about the CVE nor the images it affects.
• This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
• For more, visit Lambda Watchdog.
• This issue was created automatically by Lambda Watchdog.