CVE-2026-102277: 
JavaScript vulnerability analysis and mitigation

CVE-2026-102277 is a CPU denial-of-service vulnerability in the brace-expansion npm library caused by quadratic-time processing of specially crafted brace patterns. The expand function handles {a},b}-shaped input with many trailing closing braces by restarting its full scan once per trailing }, resulting in O(n²) CPU time and memory consumption that can block the Node.js event loop. Affected versions span all major release lines: < 1.1.21, >= 2.0.0 < 2.1.7, >= 3.0.0 < 3.0.9, and >= 4.0.0 < 5.0.12. It was published on September 28, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an inefficient algorithmic complexity flaw (CWE-407, CWE-400, CWE-606) in the expand function's handling of the Bash quirk where {a},b} still expands. The parser implements this by rewriting the string and restarting the scan, absorbing exactly one } per pass — so n trailing braces trigger n full re-scans. A compounding factor is that each rewrite replaces the closing } with an escClose sentinel (~25 characters), causing the working string to grow linearly per pass; a 1 KB input can inflate to ~26 KB, multiplying both CPU cost and peak memory. Benchmarks confirm the quadratic behavior: 128 KB of input ('{a}' + '}'.repeat(128000) + ',z}') blocks the event loop for ~27.7 seconds to produce only two results, and the existing max/maxLength guards are ineffective because the cost occurs during parsing before any results are generated (GitHub Advisory, Patch Commit).

Successful exploitation causes a recoverable CPU denial of service in Node.js applications that pass untrusted input to brace-expansion's expand() function, either directly or indirectly through dependent libraries such as minimatch or glob. The Node.js event loop can be blocked for tens of seconds per malicious request — a full stall for single-threaded servers — degrading availability for all concurrent users. There is no impact on confidentiality or data integrity; the process eventually recovers once expansion completes (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability is remotely exploitable with no authentication or user interaction required, and NVD's SSVC assessment marks it as automatable. The EPSS score is approximately 0.30%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Red Hat CVE).

1. Identify target: Find a Node.js application that accepts user-controlled input and passes it to brace-expansion's expand() function, either directly or via minimatch, glob, or similar libraries using a vulnerable version (< 1.1.21, >= 2.0.0 < 2.1.7, >= 3.0.0 < 3.0.9, or >= 4.0.0 < 5.0.12).
2. Craft malicious payload: Construct a brace-expansion pattern with many trailing closing braces, e.g.:

   const payload = '{a}' + '}'.repeat(64000) + ',z}';

   A 64 KB payload of this shape causes ~6.9 seconds of event loop blockage; 128 KB causes ~27.7 seconds.
3. Submit payload: Send the crafted string to any application endpoint that processes it as a brace-expansion pattern (e.g., a file glob search field, path pattern input, or API parameter).
4. Achieve DoS: The server's Node.js event loop stalls for the duration of the expansion, making the application unresponsive to all other requests until processing completes (GitHub Advisory).

• Logs: Application logs showing unusually long request processing times (tens of seconds) for endpoints that accept pattern or glob inputs; Node.js event loop lag metrics spiking to multi-second values.
• Process: High sustained CPU usage by the Node.js process without a corresponding increase in throughput; process appearing hung or unresponsive during expansion of a single request.
• Network: Repeated requests containing patterns with large numbers of } characters (e.g., strings matching \{[^}]+\}\}+,) sent to glob/pattern-processing endpoints.

Upgrade brace-expansion to a patched version corresponding to the major version in use: 1.1.21, 2.1.7, 3.0.9, or 5.0.12. The fix introduces a maxRewrites option (default: 1,000) that bounds the number of times the scan may restart; past the limit, the remaining string is returned literally rather than throwing an error. As a workaround where immediate upgrade is not possible, implement input validation to reject or sanitize patterns containing excessive trailing } characters, and apply rate limiting or request size restrictions on any endpoint that processes brace-expansion patterns (GitHub Advisory, Red Hat CVE, Microsoft MSRC).

Red Hat tracked the vulnerability and assigned it a Deferred status, indicating it is acknowledged but not immediately prioritized for their product lines (Red Hat CVE). Microsoft also published an advisory for the CVE (Microsoft MSRC). The advisory credits G-Rath as the finder and katzj as coordinator. The vulnerability was noted as consistent in scoring with a prior algorithmic-complexity advisory on the same package (GHSA-3jxr-9vmj-r5cp), reflecting a pattern of ReDoS-class issues in the library (GitHub Advisory).