{"id":"GHSA-q2hr-2g5m-vwhr","revision":null,"records":[{"revision":"099cfc8fbe3c4d5f86f5c861c272904f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102277","aliases":[],"title":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","state":0,"publishedAt":"2026-09-28T20:54:46.16+00:00","modifiedAt":"2026-09-29T19:38:56.637+00:00","affected":[{"ecosystem":"Vendor product","name":"brace-expansion","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"juliangruber\",\n                    \"product\": \"brace-expansion\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 5.0.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, < 3.0.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, < 2.1.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 1.1.21\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102277","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102277","identifiers":["CVE-2026-102277"]},"retained":false,"historicalAffected":[]},{"revision":"4973d5edf7bf46df8d22272cc14b01e5","observedAt":"2026-11-11T05:28:46.971+00:00","statement":{"source":"euvd","id":"EUVD-2026-88551","aliases":["CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by rest…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":null}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88551","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 28, 2026, 8:54:46 PM","dateUpdated":"Sep 29, 2026, 7:38:56 PM"},"relatedAdvisories":[{"id":"RHSA-2026:74161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:74168","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:92378","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-101911","CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106071","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"]},{"id":"RHSA-2026:92376","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-101911","CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106071","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"]},{"id":"RHSA-2026:74167","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"openSUSE-SU-2026:11967-1","title":"pi-coding-agent-1.0.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-102277","CVE-2026-102278"]},{"id":"openSUSE-SU-2026:22111-1","title":"Security update for pi-coding-agent","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-84890","CVE-2026-84933","CVE-2026-84947","CVE-2026-84961","CVE-2026-85008","CVE-2026-85014","CVE-2026-85024","CVE-2026-85152"]},{"id":"openSUSE-SU-2026:12424-1","title":"agama-web-ui-25+475.275dd4727-56.1 on GA media","vulnerabilityIds":["CVE-2026-102277","CVE-2026-110725","CVE-2026-111181","CVE-2026-111755","CVE-2026-111756","CVE-2026-115754","CVE-2026-115897","CVE-2026-116689","CVE-2026-75899","CVE-2026-84369","CVE-2026-86472"]},{"id":"msrc_CVE-2026-102277","title":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","vulnerabilityIds":["CVE-2026-102277"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88551","identifiers":["EUVD-2026-88551","CVE-2026-102277","GHSA-q2hr-2g5m-vwhr"]},"retained":false,"historicalAffected":[]},{"revision":"f54b77f08aa5418d87260238a73be06c","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-102277","aliases":[],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by rest…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","state":0,"publishedAt":"2026-09-28T21:17:16.3+00:00","modifiedAt":"2026-09-30T19:57:08.043+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-400","CWE-407"],"productCriteria":[],"sourceDates":{"published":"2026-09-28T21:17:16.300","lastModified":"2026-09-30T19:57:08.043"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-102277","identifiers":["CVE-2026-102277"]},"retained":false,"historicalAffected":[]},{"revision":"c46effd941334d518b715e22a2d694c8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-q2hr-2g5m-vwhr","aliases":["CVE-2026-102277"],"title":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","description":"### Summary\n\nExpanding `{a},b}`-shaped input takes time quadratic in the number of literal `}` characters, blocking the event loop.\n\nBash preserves a quirk where a brace group followed by a comma set still expands (`{a},b}`). The parser implements this by rewriting the string and restarting the scan. Each pass absorbs exactly one `}` and re-scans from the beginning, so `n` trailing braces cost `n` full passes.\n\n### Reproduction\n\n```js\nconst build = n => '{a}' + '}'.repeat(n) + ',z}'\n\nfor (const n of [8000, 16000, 32000, 64000, 128000]) {\n  const t = Date.now()\n  expand(build(n))\n  console.log(n, Date.now() - t + 'ms')\n}\n```\n\n| n | input | time | results |\n|---|---|---|---|\n| 8,000 | 8 KB | 110 ms | 2 |\n| 16,000 | 16 KB | 446 ms | 2 |\n| 32,000 | 32 KB | 1.7 s | 2 |\n| 64,000 | 64 KB | 6.9 s | 2 |\n| 128,000 | 128 KB | **27.7 s** | 2 |\n\n`ms/n^2` is flat at ~1.7 and each doubling of `n` costs exactly 4.0x - quadratic. 128 KB of input blocks the event loop for nearly half a minute to produce two results.\n\n### Mechanism\n\nInstrumenting the rewrite branch confirms it runs exactly `n + 1` times, once per literal `}`, each re-scanning the whole string.\n\nThere is a second multiplier. The rewrite replaces the group's closing `}` with the internal `escClose` sentinel, which is `'\\0CLOSE' + Math.random() + '\\0'` - about 25 characters. The working string therefore *grows* by ~25 characters on every pass:\n\n| n | input length | final string length |\n|---|---|---|\n| 1,000 | 1,006 | 26,006 |\n| 8,000 | 8,006 | 208,006 |\n\nSo the input is inflated roughly 26x, and that factor multiplies both the quadratic constant and peak memory. This makes it partly a memory-pressure issue as well as a CPU one.\n\n### Why `max` and `maxLength` do not help\n\nThe cost is in parsing, before the result set exists. The payload yields 2 results regardless of size, so neither bound is ever reached.\n\n### Impact\n\nAn application passing an untrusted pattern to `expand()`, directly or through `minimatch` / `glob`, can have its event loop blocked for tens of seconds by a payload well under minimatch's 65,536-character cap. For a single-threaded Node server that is a full stall, not just a slow request.\n\nDegraded availability rather than a crash - the process recovers once the expansion completes.\n\n### Affected versions\n\nVerified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, all within a few percent of each other (~460-490 ms at n=16,000).\n\n### Patch\n\nThe rewrite loop gets an iteration bound. Past the cap the remaining string is treated as non-expanding and returned literally, consistent with the existing `max` / `maxLength` caps, which truncate rather than throw.\n\nNote this bounds the number of passes, not the cost of each: worst-case work remains proportional to `cap x input length`. The cap is set low enough that the residual is bounded in practice, and far above what any realistic `{a},b}` input needs.\n\n### Severity note\n\nScored 5.3 Medium (`A:L`) for consistency with GHSA-3jxr-9vmj-r5cp, the other algorithmic-complexity advisory on this package (CWE-407), which uses the same vector. The stack-exhaustion advisories on this package score `A:H` because they crash the process outright; this one stalls it.","state":0,"publishedAt":"2026-09-29T23:45:39+00:00","modifiedAt":"2026-09-30T00:00:03.8495412+00:00","affected":[{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"5.0.12"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.9"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.1.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.21"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion"],"sourceUrl":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-q2hr-2g5m-vwhr","identifiers":["GHSA-q2hr-2g5m-vwhr","CVE-2026-102277"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T05:58:40.9203184+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T05:58:40.9203184+00:00","lastSuccessAt":"2026-11-12T05:58:41.095627+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:58:41.0956282+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-88a69dfec4d1b83d929ca06b957aa3a4484cd80632df1e27cf4c312635b2bedd","complete":true,"records":424594,"lastAttemptAt":"2026-11-12T05:56:53.4810169+00:00","lastSuccessAt":"2026-11-12T05:56:53.4611758+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:56:53.4810169+00:00","snapshotPublishedAt":"2026-11-12T05:28:30+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-dfa2c4aaec6f4aecad791663dd265c1b","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T06:00:32.7256045+00:00","lastSuccessAt":"2026-11-12T06:00:32.721+00:00","error":null,"lastVerifiedAt":"2026-11-12T06:00:32.721+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T05:58:40.9203184+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T05:58:40.9203184+00:00","lastSuccessAt":"2026-11-12T05:58:41.0963887+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:58:41.0963888+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-6b3a361b3e0f452d8ff70bd272635b35","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T05:59:00.2510884+00:00","lastSuccessAt":"2026-11-12T05:59:00.248+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:59:00.248+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T05:58:40.8633143+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:58:40.8633143+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T05:56:53.625749+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:56:53.625749+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T05:58:40.8782632+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:58:40.8782632+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-eb5176d73e87a862c4cae7484f3fd31f7d170139114b3e99e25926d661f6435b","complete":true,"records":231700,"lastAttemptAt":"2026-11-12T05:58:40.7363027+00:00","lastSuccessAt":"2026-11-12T05:58:39.2691741+00:00","error":null,"lastVerifiedAt":"2026-11-12T05:58:40.7363027+00:00","snapshotPublishedAt":"2026-11-12T05:48:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}