CVE-2026-102277 in brace-expansion
Summary
by MITRE • 09/29/2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The brace-expansion library, widely utilized in Node.js environments for generating string permutations based on pattern matching, contains a critical performance vulnerability affecting versions prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12. This flaw is rooted in the algorithmic inefficiency of the expand function when processing specific malformed input patterns characterized by an untrusted prefix followed by a sequence containing many trailing closing braces. The vulnerability manifests as a quadratic time complexity issue, where the computational cost increases exponentially relative to the length of the malicious payload rather than linearly. This behavior is particularly dangerous in single-threaded event-driven environments like Node.js, where blocking operations can halt all concurrent processing tasks.
The technical root cause lies in how the library handles nested or malformed brace structures that do not conform to standard expansion rules but still trigger internal parsing logic. When the expand function encounters patterns such as those with excessive trailing closing braces, it initiates a full rescan of the input string for each additional closing brace encountered. This repetitive rescanning mechanism means that if an attacker provides a string with N trailing closing braces after a common prefix and suffix structure, the library performs approximately N squared operations to process the input. As the working string grows during these successive scans, memory allocation also increases proportionally, leading to significant pressure on system resources.
The operational impact of this vulnerability is primarily a recoverable CPU denial of service. Because Node.js operates on an event loop model that relies on non-blocking I/O and rapid task switching, any operation that consumes excessive CPU cycles without yielding control back to the loop will cause noticeable latency spikes or complete freezes in application responsiveness. In a production environment, such as a web server processing user input, this could result in service unavailability for other users while one malicious request is being processed. Although the process eventually recovers after completing the computation, the temporary blockage can disrupt real-time applications, degrade user experience, and potentially be exploited to exhaust system resources if multiple requests are sent simultaneously.
From a classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption leading to denial of service conditions. It also relates to CWE-730, involving timing attacks or performance degradation due to inefficient algorithms that can be triggered by specific inputs. In the context of the MITRE ATT&CK framework, this behavior could facilitate a Denial of Service (T1499) attack vector where an adversary aims to disrupt service availability through resource exhaustion rather than system compromise. The lack of input validation or complexity limits allows attackers to craft payloads that disproportionately impact server performance without requiring authentication or elevated privileges.
Mitigation strategies focus on immediate version upgrades and defensive coding practices. Organizations using the brace-expansion library must upgrade to patched versions, specifically 1.1.21, 2.1.7, 3.0.9, or 5.0.12, which implement algorithmic improvements to prevent quadratic behavior during expansion of malformed patterns. For applications where upgrading is not immediately feasible, input sanitization should be implemented to reject strings with excessive nesting depth or unusual brace structures before they reach the library functions. Additionally, implementing timeouts for long-running JavaScript tasks can help mitigate the impact by terminating processes that exceed expected execution times, thereby protecting the event loop from being blocked indefinitely by malicious inputs.