brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Published Sep 28, 2026
5.3
MEDIUMCVSS 3.1
EPSS 0.30%
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Affected products
-
- Version < 1.1.21StatusaffectedConstraints-
- Version >= 2.0.0, < 2.1.7StatusaffectedConstraints-
- Version >= 3.0.0, < 3.0.9StatusaffectedConstraints-
- Version >= 4.0.0, < 5.0.12StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juliangruber | Brace-Expansion | n/a |
|
No data.
No data.
Red Hat Hardened Images
dotnet8.0
Not affected
Red Hat Hardened Images
grafana12.4
Affected
Red Hat Hardened Images
grafana13.1
Affected
Red Hat Hardened Images
grafana13.2
Affected
Red Hat Hardened Images
jaeger
Not affected
Red Hat Hardened Images
llvm21
Not affected
Red Hat Hardened Images
nodejs20
Will not fix
Red Hat Hardened Images
nodejs22
Affected
Red Hat Hardened Images
nodejs24
Affected
Red Hat Hardened Images
nodejs25
Will not fix
Red Hat Hardened Images
nodejs26
Affected
Red Hat Hardened Images
opentelemetry-collector
Not affected
Red Hat Hardened Images
opentelemetry-collector-contrib
Not affected
Red Hat Hardened Images
opentelemetry-collector-k8s
Not affected
Red Hat Hardened Images
prometheus3.13
Not affected
Red Hat Hardened Images
rust
Not affected
Red Hat Hardened Images
swift-lang
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | dotnet8.0 | Not affected | n/a |
| Red Hat Hardened Images | grafana12.4 | Affected | n/a |
| Red Hat Hardened Images | grafana13.1 | Affected | n/a |
| Red Hat Hardened Images | grafana13.2 | Affected | n/a |
| Red Hat Hardened Images | jaeger | Not affected | n/a |
| Red Hat Hardened Images | llvm21 | Not affected | n/a |
| Red Hat Hardened Images | nodejs20 | Will not fix | n/a |
| Red Hat Hardened Images | nodejs22 | Affected | n/a |
| Red Hat Hardened Images | nodejs24 | Affected | n/a |
| Red Hat Hardened Images | nodejs25 | Will not fix | n/a |
| Red Hat Hardened Images | nodejs26 | Affected | n/a |
| Red Hat Hardened Images | opentelemetry-collector | Not affected | n/a |
| Red Hat Hardened Images | opentelemetry-collector-contrib | Not affected | n/a |
| Red Hat Hardened Images | opentelemetry-collector-k8s | Not affected | n/a |
| Red Hat Hardened Images | prometheus3.13 | Not affected | n/a |
| Red Hat Hardened Images | rust | Not affected | n/a |
| Red Hat Hardened Images | swift-lang | Not affected | n/a |
brace-expansion
npm
Introduced 0 Fixed 1.1.21brace-expansion
npm
Introduced 4.0.0 Fixed 5.0.12brace-expansion
npm
Introduced 3.0.0 Fixed 3.0.9brace-expansion
npm
Introduced 2.0.0 Fixed 2.1.7
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | brace-expansion | 0 | 1.1.21 |
| npm | brace-expansion | 4.0.0 | 5.0.12 |
| npm | brace-expansion | 3.0.0 | 3.0.9 |
| npm | brace-expansion | 2.0.0 | 2.1.7 |
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Sep 29, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Not enough EPSS history yet for a chart. At least two recorded scores are needed.
Percentile over time
Not enough EPSS history yet for a chart. At least two recorded scores are needed.
References (10)
- https://access.redhat.com/security/cve/CVE-2026-102277 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542706 Issue Tracking
- https://github.com/advisories/GHSA-q2hr-2g5m-vwhr Advisory
- https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96 x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22 x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364 x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-102277
- https://www.cve.org/CVERecord?id=CVE-2026-102277
Change history (0)
No recorded changes yet.