CVE-2026-102277

A flaw was found in brace-expansion. A remote attacker can cause a Denial of Service (DoS) by supplying specially crafted string patterns with repeated closing braces. Processing these malformed patterns causes the string expansion logic to repeatedly rescan the entire input, leading to excessive processor and memory consumption that can temporarily block the application event loop.

A moderate-impact denial of service vulnerability was found in brace-expansion, an npm package bundled as a dependency in a large number of Red Hat products that ship Node.js-based components. When an application passes attacker-controlled input to the expand function, a remote unauthenticated attacker can supply a crafted {a},b}-shaped pattern containing many trailing closing braces. The parser rewrites the string and restarts its scan once for each trailing closing brace, and every pass rescans the entire input, resulting in quadratic CPU time and memory consumption. This can block the Node.js event loop of the affected process and temporarily disrupt application availability; the process recovers once the expansion completes, making this a recoverable CPU denial of service with no impact on confidentiality or integrity. The large majority of Red Hat product streams that ship a bundled copy of brace-expansion are affected; a small number of shipped components are marked not affected because the vulnerable code is not present in the shipped version or because those components do not include brace-expansion. For most affected streams the fix is deferred to a routine future component update, since the flaw is a recoverable, availability-only denial of service of low severity; the residual risk of deferral is temporary CPU and memory pressure and event-loop blocking when an attacker is able to supply crafted brace patterns to an affected application's expansion call. For streams where remediation is delegated, the maintainers of the bundled component are pursuing a fix, and a small number of streams have already shipped an update that remediates the issue. The Red Hat severity of MODERATE (CVSS 3.1 score 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the upstream assessment, so there is no meaningful difference from upstream severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating the bundled brace-expansion dependency to a version that contains the upstream fix (1.1.21, 2.1.7, 3.0.9, or 5.0.12, depending on the major version in use) resolves the issue.