CVE-2026-102277

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-28

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-30

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-16

NVD

CVE-2026-102277

Affected Vendors & Products

Vendor	Product	Version / Range
juliangruber	brace-expansion	>= 4.0.0, < 5.0.12
juliangruber	brace-expansion	>= 3.0.0, < 3.0.9
juliangruber	brace-expansion	>= 2.0.0, < 2.1.7
juliangruber	brace-expansion	< 1.1.21

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves the brace-expansion library generating arbitrary strings with a common prefix and suffix. When processing untrusted patterns with many trailing closing braces, the expand function repeatedly rescans the input, causing quadratic CPU time and memory usage growth. This leads to a recoverable CPU denial of service by blocking the Node.js event loop.

Detection Guidance

This vulnerability can be detected by checking the version of the brace-expansion library in use. If the version is below 1.1.21, 2.1.7, 3.0.9, or 5.0.12, the system is vulnerable. Commands like 'npm list brace-expansion' or 'find / -name package.json -exec grep brace-expansion {} \;' can help identify the installed version.

Impact Analysis

The vulnerability can cause high CPU and memory usage, slowing down or temporarily freezing applications using affected versions of the brace-expansion library. It may disrupt services relying on Node.js, especially those processing user-controlled input with brace patterns.

Compliance Impact

This vulnerability causes a recoverable CPU denial of service due to quadratic CPU time and memory pressure from processing untrusted brace-expansion patterns. While it does not directly expose data, it could disrupt system availability, potentially impacting compliance with GDPR (availability principle) or HIPAA (accessibility requirements) if services become unavailable.

Mitigation Strategies

Update the brace-expansion library to versions 1.1.21, 2.1.7, 3.0.9, or 5.0.12 or later to resolve the issue.

Hi! I’m here to help you understand CVE-2026-102277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70