# CVE-2026-102277: brace-expansion quadratic CPU consumption denial of service

Source: https://junglewise.ai/threats/cve-2026-102277-the-brace-expansion-library-generates-arbitrary-strings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-102277 · Severity: medium · CVSS 5.3 · Published 2026-09-28

The brace-expansion library, which expands shell-style brace patterns in Node.js, is vulnerable to denial of service when processing specially crafted input patterns. An attacker can send a pattern with many trailing closing braces that causes the parser to repeatedly scan and rewrite the entire input string, consuming CPU and memory quadratically and blocking the application's event loop until it recovers.

Technologies: [brace-expansion (npm)](https://junglewise.ai/threats/technologies/brace-expansion). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-102277 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102277 being exploited in the wild.

**How severe is CVE-2026-102277?** Medium severity, with a CVSS score of 5.3, published 28 September 2026.

**Which products and versions are affected?** Julian Gruber Brace-Expansion before 1.1.21, before 2.1.7, before 3.0.9, before 5.0.12; brace-expansion (npm) SEMVER:introduced=4.0.0,fixed=5.0.12.

**Is there a fix for CVE-2026-102277?** Yes. brace-expansion (npm): upgrade to 5.0.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102277 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102277?** Check whether you run Julian Gruber Brace-Expansion or brace-expansion (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- brace-expansion (npm): upgrade to 5.0.12 or later

  ```sh
  npm install brace-expansion@5.0.12
  ```


## Technical details

The expand function handles brace patterns like {a},b} by restarting its scan once per trailing closing brace, causing quadratic CPU time and memory growth. The vulnerability affects versions before 1.1.21, 2.1.7, 3.0.9, and 5.0.12, and is triggered by malicious untrusted input. The fix introduces a limit on rewrite iterations (maxRewrites) to bound processing time to linear complexity relative to input length.

## Affected products

- Julian Gruber brace-expansion before 1.1.21, before 2.1.7, before 3.0.9, before 5.0.12

## Identifiers

- CVE-2026-102277
- GHSA-q2hr-2g5m-vwhr

## Timeline

- 2026-09-28: disclosed

## References

- [https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96](https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96)
- [https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22](https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22)

## Related threats

- [brace-expansion stack exhaustion in deeply nested brace groups](https://junglewise.ai/threats/cve-2026-102278-the-brace-expansion-library-generates-arbitrary-strings)
- [brace-expansion stack exhaustion denial of service](https://junglewise.ai/threats/cve-2026-102276-the-brace-expansion-library-generates-arbitrary-strings)
- [juliangruber brace-expansion Denial of Service via unbounded arrays](https://junglewise.ai/threats/cve-2026-69152-juliangruber-brace-expansion-denial-of-service-via-unbounded)
- [juliangruber brace-expansion denial of service via memory exhaustion](https://junglewise.ai/threats/cve-2026-14257-juliangruber-brace-expansion-denial-of-service-via-memory)
- [juliangruber brace-expansion denial of service in expand function](https://junglewise.ai/threats/cve-2026-13149-juliangruber-brace-expansion-denial-of-service-in-expand-function)