Denial of Service Vulnerability in Brace Expansion Library Affecting Node.js Products
CVE-2026-102277
5.3MEDIUM
What is CVE-2026-102277?
The brace-expansion library, used with Node.js, is susceptible to a denial of service issue due to improper handling of untrusted patterns with excessive trailing closing braces. This flaw causes multiple rescans of the input, resulting in linear growth of allowable memory and CPU time, which can ultimately block the Node.js event loop. This vulnerability has been rectified in subsequent versions, ensuring better management of resources during pattern expansion.
Affected Version(s)
brace-expansion >= 4.0.0, < 5.0.12 < 4.0.0, 5.0.12
brace-expansion >= 3.0.0, < 3.0.9 < 3.0.0, 3.0.9
brace-expansion >= 2.0.0, < 2.1.7 < 2.0.0, 2.1.7