CVE-2026-102277
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
How to fix
- brace-expansion5.0.12, 3.0.9, 2.1.7, 1.1.21 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| brace-expansionnpm | 4.0.0 ≤ v < 5.0.12, 3.0.0 ≤ v < 3.0.9, 2.0.0 ≤ v < 2.1.7, v < 1.1.21 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.