CVE-2026-102277 · GHSA-q2hr-2g5m-vwhr
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
- Risk score
- 41/100
- CVSS
- 5.3 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input…
- Affected
- brace-expansion (npm) >= 4.0.0, < 5.0.12; brace-expansion (npm) >= 3.0.0, < 3.0.9; brace-expansion (npm) >= 2.0.0, < 2.1.7; brace-expansion (npm) < 1.1.21
- Fix
- Upgrade brace-expansion to 5.0.12 or 3.0.9 or 2.1.7 or 1.1.21 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
brace-expansion: Amber, patch this week. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass e…
The flaws
- CVE-2026-102277: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service (CVSS 5.3 · EPSS 0%)
- CVE-2026-102276: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (CVSS 7.5 · EPSS 0%)
- CVE-2026-102278: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (CVSS 7.5 · EPSS 0%)
The fix
Upgrade brace-expansion: 1.1.21 · 2.1.7 · 3.0.9 · 5.0.12 · 1.1.19 · 2.1.5 or later on your release line
Who is exposed: brace-expansion (npm) >= 4.0.0, < 5.0.10; brace-expansion (npm) >= 3.0.0, < 3.0.7; brace-expansion (npm) >= 2.0.0, < 2.1.5; brace-expansion (npm) < 1.1.19
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 251 other warnings in 30 days
Why it is Yellow
- CVSS 5.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| brace-expansion | npm | >= 4.0.0, < 5.0.12 | 5.0.12 |
| brace-expansion | npm | >= 3.0.0, < 3.0.9 | 3.0.9 |
| brace-expansion | npm | >= 2.0.0, < 2.1.7 | 2.1.7 |
| brace-expansion | npm | < 1.1.21 | 1.1.21 |
References
- https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
- https://nvd.nist.gov/vuln/detail/CVE-2026-102277
- https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96
- https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22
- https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364
- https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e
- https://github.com/advisories/GHSA-q2hr-2g5m-vwhr
Original description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Last activity 28 Sep 2026. Patch Forecast updates every hour.