CVE-2026-33750

High

Advisory

Published 26 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 36th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 869; of 17,787 indexed, latest versions
Container images: 918; deployed by those charts
Fix available: 1 of 2; affected packages

brace-expansion: Zero-step sequence causes process hang and memory exhaustion

Carried by container images the latest versions of 869 of 17,787 indexed charts deploy, on 918 images.

Affected package	Affected versions	Fixed in	Images
node-brace-expansiondeb	1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1, 2.0.1+~1.1.0-2	no fix listed	7
brace-expansionnpm	1.1.1, 1.1.2, 1.1.4, 1.1.6+9 more	1.1.13, 2.0.3, 5.0.5	918

OSV records: DEBIAN-CVE-2026-33750 GHSA-f886-m6hf-6m8v UBUNTU-CVE-2026-33750

Charts affected

869 by stars

Chart

Latest

Affected images

Radar Score

websitewaldo-vision

0.33.0

2 of 2 See more

website waldo-vision 0.33.0

2 of the 2 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
ghcr.io/waldo-vision/migrate :v0.3.6	ae31923312ed	brace-expansion@1.1.11	1.1.13
ghcr.io/waldo-vision/web :v0.3.6	5bbc7647df07	brace-expansion@1.1.11	1.1.13

Open the chart page →

3,474

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	brace-expansion@2.0.1	2.0.3

Open the chart page →

5,774

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	brace-expansion@1.1.11	1.1.13

Open the chart page →

5,484

queryservice-gatewaywbstack

0.2.0

1 of 1 See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	brace-expansion@1.1.11	1.1.13

Open the chart page →

2,559

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	brace-expansion@1.1.11	1.1.13

Open the chart page →

14,420

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	brace-expansion@1.1.11	1.1.13

Open the chart page →

28,699

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
ubercadence/web :v3.29.5	8564a5b44a6d	brace-expansion@1.1.11	1.1.13

Open the chart page →

10,127

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	brace-expansion@1.1.11	1.1.13

Open the chart page →

22,665

verdacciowenerme

4.35.1

1 of 1 See more

verdaccio wenerme 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
verdaccio/verdaccio :6.10.2	09b403888c8f	brace-expansion@5.0.4	5.0.5

Open the chart page →

215

wikiwikijs

3.0.0

1 of 2 See more

5,472

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	brace-expansion@1.1.11	1.1.13

Open the chart page →

6,323

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	brace-expansion@1.1.11	1.1.13

Open the chart page →

5,807

playwright-synthetic-monitoringwork-adventure

1.0.1

1 of 1 See more

playwright-synthetic-monitoring work-adventure 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	brace-expansion@1.1.11	1.1.13

Open the chart page →

14,172

workadventureworkadventure

1.1.0

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	brace-expansion@1.1.11	1.1.13
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	brace-expansion@2.0.1	2.0.3
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	brace-expansion@1.1.11	1.1.13
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	brace-expansion@1.1.11	1.1.13

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
ymuski/skooner :latest	67819ca511b5	brace-expansion@1.1.11	1.1.13

Open the chart page →

1,752

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	brace-expansion@1.1.11	1.1.13

Open the chart page →

9,381

helloworldyotron-helm-charts

0.1.0

1 of 1 See more

helloworld yotron-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
a5hut0sh/helloworld :1.0	2ae77620e616	brace-expansion@1.1.11	1.1.13

Open the chart page →

1,309

sockpuppetbrowserzekker6

0.1.0

1 of 1 See more

sockpuppetbrowser zekker6 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
dgtlmoon/sockpuppetbrowser :latest	f166a963b550	brace-expansion@1.1.11	1.1.13

Open the chart page →

1,588

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2026-33750.

Container image	Digest	Package	Fixed in
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	brace-expansion@1.1.11	1.1.13

Open the chart page →

3,118

Container images carrying it

918 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
koenkk/zigbee2mqtt :1.19.1	5f9129b1ffbc	brace-expansion@1.1.11	1.1.13	2
krtk6160/galoy-nostr	cc82a694f818	brace-expansion@2.0.1	2.0.3	2
kutt/kutt :latest :v3.2.6	fa3d24a89b04	brace-expansion@2.0.2	2.0.3	2
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	brace-expansion@1.1.11	1.1.13	2
langgenius/dify-sandbox :0.2.0	09b7e8705673	brace-expansion@2.0.1	2.0.3	2
library/arangodb :3.11.8	1e75d74954a4	brace-expansion@2.0.1	2.0.3	2
library/ghost :6.63.0	e05bc1169fb2	brace-expansion@2.0.2	2.0.3	2
library/mongo-express :1.0.2 :latest	1b23d7976f02	brace-expansion@2.0.1	2.0.3	2
louislam/uptime-kuma :2.5.4	917318f9d7be	brace-expansion@2.0.2	2.0.3	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	brace-expansion@2.0.2	2.0.3	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	brace-expansion@2.0.2	2.0.3	2
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	brace-expansion@1.1.11	1.1.13	2
mesosphere/kommander :6.100.1	3917e82333a9	brace-expansion@1.1.11	1.1.13	2
migmartri/prerender :latest	486aacfd5aa9	brace-expansion@1.1.7	1.1.13	2
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	brace-expansion@1.1.11	1.1.13	2
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	brace-expansion@1.1.11	1.1.13	2
mojaloop/reporting :v12.1.0	d480a62103d6	brace-expansion@1.1.11	1.1.13	2
mojaloop/reporting-aggregator-svc :v0.0.9	2635baf23298	brace-expansion@2.0.1	2.0.3	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	brace-expansion@2.0.2	2.0.3	2
mojaloop/reporting-hub-bop-api-svc :v4.1.2	b45a2d6f0f2a	brace-expansion@1.1.12	1.1.13	2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	brace-expansion@2.0.1	2.0.3	2
mojaloop/role-assignment-service :v2.1.0	def4bf273721	brace-expansion@1.1.11	1.1.13	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	brace-expansion@1.1.12	1.1.13	2
moreillon/api-proxy :a3e8b41e	9e578c9653b6	brace-expansion@2.0.1	2.0.3	2
moreillon/group-manager :v4.9.0	d5a0ec8394c0	brace-expansion@1.1.11	1.1.13	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	brace-expansion@1.1.11	1.1.13	2
opensearchproject/opensearch-dashboards :1.0.0	39695180364b	brace-expansion@1.1.11	1.1.13	2
outlinewiki/outline :0.69.1	d060dcd8f9aa	brace-expansion@1.1.11	1.1.13	2
rajnandan1/kener :3.2.19	30407afca731	brace-expansion@1.1.11	1.1.13	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	brace-expansion@1.1.11	1.1.13	2
requarks/wiki :2 :latest	68f0d1848261	brace-expansion@5.0.4	5.0.5	2
shahanafarooqui/rtl :0.13.3	e2195188a451	brace-expansion@2.0.1	2.0.3	2
speckle/speckle-preview-service :2.18.11-branch.testing2.88634-335d469 :2.18.12-branch.testing3.88744-f55b341	4bd113093583	brace-expansion@2.0.1	2.0.3	2
stakater/stakater-nordmart-review-ui :1.0.14	3f4926eedc74	brace-expansion@1.1.11	1.1.13	2
statsd/statsd :v0.8.6	dab129e74c25	brace-expansion@1.1.11	1.1.13	2
sysnet4admin/dashboard :blue	c5bd3bb1b5a6	brace-expansion@2.0.1	2.0.3	2
taigaio/taiga-events :latest	92fc0822564f	brace-expansion@2.0.1	2.0.3	2
taskrabbit/elasticsearch-dump :latest	c967fe68b9c7	brace-expansion@1.1.11	1.1.13	2
tzahi12345/youtubedl-material :4.3.2 :latest	2f943d584711	brace-expansion@1.1.11	1.1.13	2
verdaccio/verdaccio :6.10.2	09b403888c8f	brace-expansion@5.0.4	5.0.5	2
ghcr.io/bryopsida/k8s-dev-pod :main	82d0b161161d	brace-expansion@2.0.1	2.0.3	2
ghcr.io/codingducksrl/laravel :8.1	5be52524664c	brace-expansion@2.0.1	2.0.3	2
ghcr.io/cross-seed/cross-seed :6.13.3	81afafdd96a5	brace-expansion@2.0.1	2.0.3	2
ghcr.io/danbooru/danbooru :9cab67c0ac72a8c52289302c519715ceec2372d9	5f545698e907	brace-expansion@1.1.11	1.1.13	2
ghcr.io/gethomepage/homepage :latest :v2.2.0	753eeb0cc22a	brace-expansion@2.0.2	2.0.3	2
ghcr.io/lissy93/dashy :2.1.1	acb40032ad4b	brace-expansion@1.1.11	1.1.13	2
ghcr.io/lissy93/web-check :latest	a4e021c0f6a9	brace-expansion@2.0.2	2.0.3	2
ghcr.io/nucleuscloud/neosync/app :0.5.41	ca31ec35b829	brace-expansion@2.0.1	2.0.3	2
ghcr.io/techno-tim/littlelink-server :latest	e84ea9d93b60	brace-expansion@2.0.1	2.0.3	2
ghcr.io/wg-easy/wg-easy :14	5f26407fd2ed	brace-expansion@2.0.1	2.0.3	2