CVE-2026-102277: CWE-400: Uncontrolled Resource Consumption in juliangruber brace-expansion
CVE-2026-102277 is a medium severity vulnerability in the juliangruber brace-expansion library that causes uncontrolled resource consumption. The expand function in affected versions repeatedly rescans input patterns with many trailing closing braces, leading to quadratic CPU and memory usage. This results in a recoverable denial of service by blocking the Node.js event loop. The issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
AI Analysis
Technical Summary
The brace-expansion library generates strings with common prefixes and suffixes. Versions prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12 have a flaw in the expand function where untrusted patterns containing many trailing closing braces cause the function to restart scanning once per trailing brace. This results in successive rescans of the full input with linear growth of the working string, causing quadratic CPU time and memory consumption. The Node.js event loop can be blocked temporarily, causing a recoverable CPU denial of service. The vulnerability is addressed by fixes in the specified versions.
Potential Impact
Exploitation of this vulnerability leads to a denial of service condition by consuming excessive CPU and memory resources, blocking the Node.js event loop. The impact is recoverable as the process eventually recovers, but it can cause temporary service disruption. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This vulnerability is fixed in brace-expansion versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required once patched.
CVE-2026-102277: CWE-400: Uncontrolled Resource Consumption in juliangruber brace-expansion
Description
CVE-2026-102277 is a medium severity vulnerability in the juliangruber brace-expansion library that causes uncontrolled resource consumption. The expand function in affected versions repeatedly rescans input patterns with many trailing closing braces, leading to quadratic CPU and memory usage. This results in a recoverable denial of service by blocking the Node.js event loop. The issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
CVSS v3.1
Score 5.3medium
Affected software
juliangruber
brace-expansion
pkg:npm/brace-expansionRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The brace-expansion library generates strings with common prefixes and suffixes. Versions prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12 have a flaw in the expand function where untrusted patterns containing many trailing closing braces cause the function to restart scanning once per trailing brace. This results in successive rescans of the full input with linear growth of the working string, causing quadratic CPU time and memory consumption. The Node.js event loop can be blocked temporarily, causing a recoverable CPU denial of service. The vulnerability is addressed by fixes in the specified versions.
Potential Impact
Exploitation of this vulnerability leads to a denial of service condition by consuming excessive CPU and memory resources, blocking the Node.js event loop. The impact is recoverable as the process eventually recovers, but it can cause temporary service disruption. There is no impact on confidentiality or integrity.
Mitigation Recommendations
This vulnerability is fixed in brace-expansion versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required once patched.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-28T20:11:16.659Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6abad639f7a7c54106343f6e
Added to database: 09/28/2026, 21:03:53 UTC
Last enriched: 09/28/2026, 21:18:18 UTC
Last updated: 09/28/2026, 22:10:31 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.