CVE-2026-102277

Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.21 brace-expansion versions prior to 2.1.7 brace-expansion versions prior to 3.0.9 brace-expansion versions prior to 5.0.12

Description The expand() function improperly handles untrusted patterns containing many trailing closing braces. This behavior triggers successive full-input rescans and linear working-string growth, resulting in quadratic CPU time and memory pressure. Consequently, the Node.js event loop can be blocked, leading to a recoverable CPU denial of service.

Recommendations Update to version 1.1.21 or later. Update to version 2.1.7 or later. Update to version 3.0.9 or later. Update to version 5.0.12 or later.