StackRadar

CVE-2026-45149

High

Advisory

Published 18 May 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.003
22nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
60
of 17,781 indexed, latest versions
Container images
58
deployed by those charts
Fix available
1 of 2
affected packages

brace-expansion: Large numeric range defeats documented `max` DoS protection

Carried by container images the latest versions of 60 of 17,781 indexed charts deploy, on 58 images.

Affected packageAffected versionsFixed inImages
node-brace-expansiondeb1.1.8-1, 1.1.11-1, 2.0.1+~1.1.0-1, 2.0.1+~1.1.0-2no fix listed6
brace-expansionnpm5.0.3, 5.0.4, 5.0.55.0.652
OSV records
DEBIAN-CVE-2026-45149GHSA-jxxr-4gwj-5jf2UBUNTU-CVE-2026-45149

Charts affected

60 by stars
ChartLatestAffected imagesRadar Score
verdaccioverdaccio4.35.11 of 1See more

verdaccio verdaccio 4.35.1

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
verdaccio/verdaccio:6.10.209b403888c8f
brace-expansion@5.0.4
5.0.6

Open the chart page →

215
apisix-ingress-controllerapisix1.3.11 of 2See more

apisix-ingress-controller apisix 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/api7/adc:0.27.1f65f53dd9668
brace-expansion@5.0.5
5.0.6

Open the chart page →

1,616
chatwootchatwootVerified publisher2.0.241 of 3See more

chatwoot chatwoot 2.0.24

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
chatwoot/chatwoot:v4.15.167ebc751c171
brace-expansion@5.0.5
5.0.6

Open the chart page →

9,203
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
brace-expansion@5.0.4
5.0.6

Open the chart page →

3,004
budibasebudibase0.0.0-master1 of 7See more

budibase budibase 0.0.0-master

1 of the 7 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
budibase/database:2.1.0d90f656261c9
brace-expansion@5.0.4
5.0.6

Open the chart page →

10,775
openhabhelmforgeVerified publisher1.2.01 of 1See more

openhab helmforge 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
openhab/openhab:5.2.1bfd4a60e90da
node-brace-expansion@2.0.1+~1.1.0-2
no fix listed

Open the chart page →

3,641
dynamodbkeyporttech0.1.271 of 2See more

dynamodb keyporttech 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
aaronshaf/dynamodb-admin:latestac41724cd997
brace-expansion@5.0.5
5.0.6

Open the chart page →

1,304
bitwarden-crd-operatorlerentisVerified publisher0.18.01 of 1See more

bitwarden-crd-operator lerentis 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
brace-expansion@5.0.3
5.0.6

Open the chart page →

2,003
openclaw-with-brainopenclaw-with-brainVerified publisher0.1.671 of 3See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/openclaw/openclaw:2026.6.10af7ea052cf21
brace-expansion@5.0.5
5.0.6

Open the chart page →

5,218
kratos-selfservice-ui-nodeory0.64.01 of 1See more

kratos-selfservice-ui-node ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
brace-expansion@5.0.4
5.0.6

Open the chart page →

1,966
pacmanpacmanVerified publisher2.0.21 of 2See more

pacman pacman 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/shuguet/pacman:latesta0ec71732c3c
brace-expansion@5.0.4
5.0.6

Open the chart page →

638
pretixtechwolf12Verified publisher2026.7.01 of 3See more

pretix techwolf12 2026.7.0

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
pretix/standalone:2026.7.05df3b7aa852e
brace-expansion@5.0.4
5.0.6

Open the chart page →

9,770
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
brace-expansion@5.0.4
5.0.6

Open the chart page →

4,016
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
brace-expansion@5.0.4
5.0.6

Open the chart page →

1,991
directusdirectus-io2.1.01 of 3See more

directus directus-io 2.1.0

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
directus/directus:12.0.29c8470ea465c
brace-expansion@5.0.5
5.0.6

Open the chart page →

7,473
enbuildenbuildVerified publisher0.0.503 of 6See more

enbuild enbuild 0.0.50

3 of the 6 container images this version deploys carry CVE-2026-45149.

Open the chart page →

31,510
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
brace-expansion@5.0.4
5.0.6

Open the chart page →

2,575
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
brace-expansion@5.0.4
5.0.6

Open the chart page →

7,035
portraitportraitVerified publisher0.2.131 of 8See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
treskon/portrait-ui:DEV-lateste7970783bc8d
brace-expansion@5.0.4
5.0.6

Open the chart page →

31,844
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
brace-expansion@5.0.5
5.0.6

Open the chart page →

5,482
stornxstornxVerified publisher1.1.11 of 9See more

stornx stornx 1.1.1

1 of the 9 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
alazidis/stornx:1.1.1602d4f7f090c
brace-expansion@5.0.3
5.0.6

Open the chart page →

11,574
supabasesupabse0.8.01 of 11See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
supabase/storage-api:v1.60.4c8eb9858eafe
brace-expansion@5.0.5
5.0.6

Open the chart page →

18,075
tenuretenureVerified publisher1.0.61 of 2See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
tenureai/tenure:v1.0.285f5b222df9a5
brace-expansion@5.0.5
5.0.6

Open the chart page →

2,522
wikiwenerme2.2.01 of 2See more

wiki wenerme 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
requarks/wiki:latest68f0d1848261
brace-expansion@5.0.4
5.0.6

Open the chart page →

3,833
activepiecesadnoctemVerified publisher0.5.01 of 1See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
activepieces/activepieces:0.90.430c10a04fe3d
brace-expansion@5.0.3
5.0.6

Open the chart page →

1,055
turborepo-remote-cacheadriantr1.1.11 of 1See more

turborepo-remote-cache adriantr 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ducktors/turborepo-remote-cache:latest31ec9e83c844
brace-expansion@5.0.4
5.0.6

Open the chart page →

523
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
brace-expansion@5.0.3
5.0.6

Open the chart page →

6,486
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
brace-expansion@5.0.4
5.0.6

Open the chart page →

4,083
otbrcharts-derwitt-devVerified publisher0.2.01 of 1See more

otbr charts-derwitt-dev 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
openthread/otbr:latestf307f59f6432
node-brace-expansion@1.1.8-1
no fix listed

Open the chart page →

12,779
codehubcodehubVerified publisher6.2.181 of 5See more

codehub codehub 6.2.18

1 of the 5 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
jupyterhub/jupyterhub:5.4.63974ba945e65
node-brace-expansion@2.0.1+~1.1.0-1
no fix listed

Open the chart page →

13,220
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
brace-expansion@5.0.5
5.0.6

Open the chart page →

1,755
genieacsgenieacsVerified publisher0.5.11 of 2See more

genieacs genieacs 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
drumsergio/genieacs:1.2.16.028244054e1bf
brace-expansion@5.0.3
5.0.6

Open the chart page →

4,259
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
brace-expansion@5.0.5
5.0.6

Open the chart page →

7,633
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
brace-expansion@5.0.3
5.0.6

Open the chart page →

11,042
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
brace-expansion@5.0.5
5.0.6

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
brace-expansion@5.0.5
5.0.6

Open the chart page →

3,092
keycloak-multi-client-notifierkeycloak-multi-client-notifier2.1.21 of 2See more

keycloak-multi-client-notifier keycloak-multi-client-notifier 2.1.2

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
brace-expansion@5.0.4
5.0.6

Open the chart page →

1,473
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
brace-expansion@5.0.5
5.0.6

Open the chart page →

2,756
portfolio-trackerkubernetes-homelab-helm-chartsVerified publisher0.1.01 of 3See more

portfolio-tracker kubernetes-homelab-helm-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
brace-expansion@5.0.5
5.0.6

Open the chart page →

1,498
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
node-brace-expansion@1.1.11-1
no fix listed

Open the chart page →

17,779
lynxpromptlynxpromptVerified publisher0.1.21 of 3See more

lynxprompt lynxprompt 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
drumsergio/lynxprompt:2.0.75c6afb6679301
brace-expansion@5.0.5
5.0.6

Open the chart page →

1,852
mongo-compassmongo-compass-web-helm1.1.01 of 1See more

mongo-compass mongo-compass-web-helm 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
haohanyang/compass-web:0.5.054f2112602ee
brace-expansion@5.0.5
5.0.6

Open the chart page →

2,396
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
brace-expansion@5.0.4
5.0.6

Open the chart page →

4,960
ixyneoskop2.1.11 of 1See more

ixy neoskop 2.1.1

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
neoskop/ixy:2.1.125152b474f54
brace-expansion@5.0.4
5.0.6

Open the chart page →

1,166
nexus-tasksnexus-tasks2.0.01 of 5See more

nexus-tasks nexus-tasks 2.0.0

1 of the 5 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
brace-expansion@5.0.4
5.0.6

Open the chart page →

3,798
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
openwhisk/ow-utils:1.0.0c80dba0de3aa
node-brace-expansion@1.1.8-1
no fix listed

Open the chart page →

36,215
your-spotifyrubxkubeVerified publisher1.0.12 of 3See more

your-spotify rubxkube 1.0.1

2 of the 3 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
yooooomi/your_spotify_client:1.20.0e4da90a0634c
brace-expansion@5.0.4
5.0.6
yooooomi/your_spotify_server:1.20.0624ea009f2ef
brace-expansion@5.0.4
5.0.6

Open the chart page →

5,066
etherpadschoenwald0.3.01 of 1See more

etherpad schoenwald 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
etherpad/etherpad:2.7.2b723fe5f2594
brace-expansion@5.0.4
5.0.6

Open the chart page →

2,133
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
brace-expansion@5.0.4
5.0.6

Open the chart page →

1,991
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-45149.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
brace-expansion@5.0.4
5.0.6

Open the chart page →

5,201

Container images carrying it

58 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
brace-expansion@5.0.4
5.0.6
3
requarks/wiki:2:latest68f0d1848261
brace-expansion@5.0.4
5.0.6
2
verdaccio/verdaccio:6.10.209b403888c8f
brace-expansion@5.0.4
5.0.6
2
ghcr.io/api7/adc:0.27.1f65f53dd9668
brace-expansion@5.0.5
5.0.6
2
aaronshaf/dynamodb-admin:latestac41724cd997
brace-expansion@5.0.5
5.0.6
1
activepieces/activepieces:0.90.430c10a04fe3d
brace-expansion@5.0.3
5.0.6
1
alazidis/stornx:1.1.1602d4f7f090c
brace-expansion@5.0.3
5.0.6
1
archivebox/archivebox:0.7.41a5a37331091
brace-expansion@5.0.5
5.0.6
1
budibase/database:2.1.0d90f656261c9
brace-expansion@5.0.4
5.0.6
1
chatwoot/chatwoot:v4.15.167ebc751c171
brace-expansion@5.0.5
5.0.6
1
chocobozzz/peertube:v8.1.5052712130691
brace-expansion@5.0.4
5.0.6
1
directus/directus:12.0.29c8470ea465c
brace-expansion@5.0.5
5.0.6
1
drumsergio/genieacs:1.2.16.028244054e1bf
brace-expansion@5.0.3
5.0.6
1
drumsergio/lynxprompt:2.0.75c6afb6679301
brace-expansion@5.0.5
5.0.6
1
ducktors/turborepo-remote-cache:latest31ec9e83c844
brace-expansion@5.0.4
5.0.6
1
etherpad/etherpad:2.7.2b723fe5f2594
brace-expansion@5.0.4
5.0.6
1
evoapicloud/evolution-api:latest966625532d90
brace-expansion@5.0.4
5.0.6
1
fthomas/scala-steward:latest367afe974b7a
brace-expansion@5.0.4
5.0.6
1
haohanyang/compass-web:0.5.054f2112602ee
brace-expansion@5.0.5
5.0.6
1
joplin/server:latest3f7b852959aa
brace-expansion@5.0.5
5.0.6
1
jupyterhub/jupyterhub:5.4.63974ba945e65
node-brace-expansion@2.0.1+~1.1.0-1
no fix listed
1
library/ghost:6.37.01ef2e532ca4d
brace-expansion@5.0.5
5.0.6
1
library/ghost:6.25.12654b1e90413
brace-expansion@5.0.4
5.0.6
1
library/ghost:6.41.129773d6be407
brace-expansion@5.0.5
5.0.6
1
library/ghost:6.39.0-alpine77196da4b0df
brace-expansion@5.0.5
5.0.6
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
brace-expansion@5.0.4
5.0.6
1
litellm/litellm-non_root:v1.82.3-stable09b217802ded
brace-expansion@5.0.4
5.0.6
1
lsstsqre/nublado2:2.0.1b75bf8aaafa4
node-brace-expansion@1.1.11-1
no fix listed
1
n8nio/n8n:2.25.7761374d4eb84
brace-expansion@5.0.4
5.0.6
1
neoskop/ixy:2.1.125152b474f54
brace-expansion@5.0.4
5.0.6
1
nocodb/nocodb:0.301.5d9516f0bf546
brace-expansion@5.0.4
5.0.6
1
openhab/openhab:5.2.1bfd4a60e90da
node-brace-expansion@2.0.1+~1.1.0-2
no fix listed
1
openthread/otbr:latestf307f59f6432
node-brace-expansion@1.1.8-1
no fix listed
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
node-brace-expansion@1.1.8-1
no fix listed
1
oryd/kratos-selfservice-ui-node:v26.2.046a7bac1ad0c
brace-expansion@5.0.4
5.0.6
1
pretix/standalone:2026.7.05df3b7aa852e
brace-expansion@5.0.4
5.0.6
1
rocketadmin/rocketadmin:1.17.710955ef540b9
brace-expansion@5.0.5
5.0.6
1
supabase/storage-api:v1.60.4c8eb9858eafe
brace-expansion@5.0.5
5.0.6
1
supabase/storage-api:latestf6c42a04163d
brace-expansion@5.0.4
5.0.6
1
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
node-brace-expansion@1.1.11-1
no fix listed
1
tenureai/tenure:v1.0.285f5b222df9a5
brace-expansion@5.0.5
5.0.6
1
treskon/portrait-ui:DEV-lateste7970783bc8d
brace-expansion@5.0.4
5.0.6
1
veecode/devportalc443520aebf7
brace-expansion@5.0.5
5.0.6
1
yooooomi/your_spotify_client:1.20.0e4da90a0634c
brace-expansion@5.0.4
5.0.6
1
yooooomi/your_spotify_server:1.20.0624ea009f2ef
brace-expansion@5.0.4
5.0.6
1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend:2.0.0fcbab3a24880
brace-expansion@5.0.4
5.0.6
1
ghcr.io/blessingnator/keycloak-mcn-backend:2.0.5967470f05472
brace-expansion@5.0.4
5.0.6
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
brace-expansion@5.0.4
5.0.6
1
ghcr.io/harish2k01/portfolio-tracker:0.1.056efa3085895
brace-expansion@5.0.5
5.0.6
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
brace-expansion@5.0.3
5.0.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.