CVE-2026-13149 (HIGH): detected in Lambda Docker Images.

## CVE Details

| **CVE ID** | **Severity** | **Affected Package** | **Installed Version** | **Fixed Version** | **Date Published** | **Date of Scan** |
|-----------------|--------------|----------------------|-----------------------|-------------------|--------------------|------------------|
| [CVE-2026-13149](https://avd.aquasec.com/nvd/cve-2026-13149) | `HIGH` | `brace-expansion` | `1.1.15` | `5.0.7, 1.1.16, 2.1.2` | `2026-06-30T10:16:34.56Z` | `2026-07-22T10:18:15.468343918Z` |

---

## Affected Docker Images

| **Image Name** | **SHA** |
|-----------------------------|---------------------------------------|
| `public.ecr.aws/lambda/nodejs:latest` | `public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f` |
| `public.ecr.aws/lambda/nodejs:24` | `public.ecr.aws/lambda/nodejs@sha256:eca040a64243f44373fae948c0c1e13563d924a0b4c1b6a3c18d598f288ebf3f` |
| `public.ecr.aws/lambda/nodejs:22` | `public.ecr.aws/lambda/nodejs@sha256:7fb30f61a372768a2ee1c1af89340e2b3b69782bc1135b0101669ee1106d1d0c` |

---

## Description

> brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

---

### Remediation Steps
- Update the affected package `brace-expansion` from version `1.1.15` to `5.0.7, 1.1.16, 2.1.2`.

### About this issue
- This issue may not contain all the information about the CVE nor the images it affects.
- This issue will not be updated with new information and the list of affected images may have changed since the creation of this issue.
- For more, visit [Lambda Watchdog](https://lambdawatchdog.com).
- This issue was created automatically by Lambda Watchdog.

Start by locating the build definitions and dependency manifests used for the listed Lambda Node.js Docker images, then verify where brace-expansion 1.1.15 is introduced. Update it to a listed fixed version, rebuild the affected image tags, and rerun the vulnerability scan to confirm CVE-2026-13149 is no longer reported.

Written by the indexing model from the issue text.