CVE-2026-102277: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 1.1.21 - Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 2.1.7 - Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 3.0.9 - Upgrade
Upgrade
brace-expansionto a version that resolves this vulnerability.Fixed in 5.0.12
Event History
Frequently Asked Questions
When is an application realistically exposed?
An application is exposed if it passes attacker-controlled brace-expansion patterns to the library’s expand function. Patterns shaped like {a},b} with many trailing closing braces can consume substantial CPU and memory and block the Node.js event loop.
What does an attacker need to exploit this issue?
The attacker needs the ability to supply a crafted pattern to code that invokes expand. No authentication, user interaction, or special access is indicated by the provided vector.
Which versions contain the fix?
The issue is fixed in brace-expansion versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. Versions before those releases in their respective version lines are affected.
What is the operational impact if exploitation occurs?
The crafted input causes quadratic CPU work and memory pressure, which can block the Node.js event loop. The process eventually recovers, so the described impact is a recoverable CPU denial of service.