brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
Priority LOW 30CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 3 fixed, 50 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00428 37th percentileScored 2026-11-07
Fix Partial brace-expansion (juliangruber): 5.0.12, 3.0.9, 2.1.7 +1brace-expansion (npm): 5.0.12, 3.0.9, 2.1.7 +1Red Hat: 5 advisoriesRed Hat: 3 fixed, 50 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| juliangruber | brace-expansion | 4.0.0 to before 5.0.12; 3.0.0 to before 3.0.9; 2.0.0 to before 2.1.7; before 1.1.21 | 5.0.12, 3.0.9, 2.1.7, 1.1.21 | Patch available | CNA |
| — | brace-expansion (npm) | 4.0.0 to before 5.0.12 | 5.0.12 | Patch available | GHSA-q2hr-2g5m-vwhr |
| — | brace-expansion (npm) | 3.0.0 to before 3.0.9 | 3.0.9 | Patch available | GHSA-q2hr-2g5m-vwhr |
| — | brace-expansion (npm) | 2.0.0 to before 2.1.7 | 2.1.7 | Patch available | GHSA-q2hr-2g5m-vwhr |
| — | brace-expansion (npm) | before 1.1.21 | 1.1.21 | Patch available | GHSA-q2hr-2g5m-vwhr |
- brace-expansion Vendorjuliangruber Affected 4.0.0 to before 5.0.12; 3.0.0 to before 3.0.9; 2.0.0 to before 2.1.7; before 1.1.21 Fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21 Patch available CNA
- brace-expansion (npm) Vendor— Affected 4.0.0 to before 5.0.12 Fixed in 5.0.12 Patch available GHSA-q2hr-2g5m-vwhr
- brace-expansion (npm) Vendor— Affected 3.0.0 to before 3.0.9 Fixed in 3.0.9 Patch available GHSA-q2hr-2g5m-vwhr
- brace-expansion (npm) Vendor— Affected 2.0.0 to before 2.1.7 Fixed in 2.1.7 Patch available GHSA-q2hr-2g5m-vwhr
- brace-expansion (npm) Vendor— Affected before 1.1.21 Fixed in 1.1.21 Patch available GHSA-q2hr-2g5m-vwhr
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* | — | — | juliangruber |
- cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:*:*:* Versions — — ·juliangruber
Remediation
- Fix · CNA brace-expansion (juliangruber) Fixed in 5.0.12, 3.0.9, 2.1.7, 1.1.21
- Fix · GHSA-q2hr-2g5m-vwhr brace-expansion (npm) Fixed in 5.0.12 Advisory →
- Fix · GHSA-q2hr-2g5m-vwhr brace-expansion (npm) Fixed in 3.0.9 Advisory →
- Fix · GHSA-q2hr-2g5m-vwhr brace-expansion (npm) Fixed in 2.1.7 Advisory →
- Fix · GHSA-q2hr-2g5m-vwhr brace-expansion (npm) Fixed in 1.1.21 Advisory →
Red Hat 5 advisories
- RHSA-2026:92378 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.aarch64::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.ppc64le::nodejs:24, nodejs-1:24.22.1-3.module+el9.8.0+25216+afa2a4a4.s390x::nodejs:24 +25
- RHSA-2026:92376 Released 2026-10-29 · Red Hat rating Importantnodejs:24 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.aarch64::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.ppc64le::nodejs:24, nodejs-1:24.22.1-1.module+el8.10.0+25218+d9e131cb.s390x::nodejs:24 +25
- RHSA-2026:74168 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs26-1:26.10.0-0.3.hum1@aarch64, nodejs26-1:26.10.0-0.3.hum1@src, nodejs26-1:26.10.0-0.3.hum1@x86_64 +14
Show 2 more Red Hat advisories
- RHSA-2026:74167 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images nodejs24-1:24.21.0-1.2.hum1@aarch64, nodejs24-1:24.21.0-1.2.hum1@src, nodejs24-1:24.21.0-1.2.hum1@x86_64 +16
- RHSA-2026:74161 Released 2026-09-30 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images nodejs22-1:22.23.3-2.3.2.2.hum1@aarch64, nodejs22-1:22.23.3-2.3.2.2.hum1@src, nodejs22-1:22.23.3-2.3.2.2.hum1@x86_64 +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cost Management On Premise | Affected | No fix yet: Fix deferred |
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Exploit Intelligence | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 11 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 12 | Affected | No fix yet: Fix deferred |
| Red Hat Directory Server 13 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 2 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager 1 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Profile Analyzer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Secrets Management Console for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:92376 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:92378 |
| Red Hat Hardened Images | Fixed | RHSA-2026:74161, RHSA-2026:74167, RHSA-2026:74168 |
Not affected: 3 products
- OpenShift Lightspeed
- Red Hat Hardened Images
- Red Hat OpenShift Container Platform 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-102277
- 2026-10-03 Alias added: GHSA-q2hr-2g5m-vwhr
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-13 Affected versions changed · Red Hat
- 2026-10-15 Affected versions changed · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92378 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:92376 · Red Hat
- 2026-10-30 Fix available: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
References
Other 6
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
- https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96
- https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22
- https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364
- https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e
- https://github.com/juliangruber/brace-expansion
More juliangruber vulnerabilities
- TI-2026-48532 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation CVSS 3.1HIGH 7.5
- TI-2025-05315 juliangruber brace-expansion index.js expand redos CVSS 4.0LOW 2.3
- TI-2021-17956 Insecure random number generation CVSS 3.1CRITICAL 9.1
- TI-2026-12072 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash CVSS 3.1HIGH 7.5
- TI-2026-11166 Uncontrolled resource consumption in juliangruber brace-expansion CVSS 4.0HIGH 7.7
- TI-2026-65313 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion CVSS 3.1HIGH 7.5
Sources
- CVE-2026-102277 · CVE Program
- CVE-2026-102277 · NVD
- FIRST EPSS
- GHSA-q2hr-2g5m-vwhr · GitHub Advisory Database · CC BY 4.0
- CVE-2026-102277 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences