{"uuid": "b521476f-7004-45bb-adfb-4189e6bc6942", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-102277", "type": "seen", "source": "https://gist.github.com/alon710/81f73635485d93bb7bf1c111a00da32d", "content": "# CVE-2026-102277: CVE-2026-102277: Denial of Service via Quadratic Algorithmic Complexity in brace-expansion\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-102277\n\n## Summary\nAn uncontrolled resource consumption vulnerability exists in the brace-expansion JavaScript library. Due to an algorithmic flaw in parsing a legacy Bash-compatibility quirk involving {a},b}-shaped expansion structures, untrusted inputs containing many trailing closing braces trigger successive full-input rescans. This behavior yields quadratic CPU time complexity and high memory overhead, allowing remote, unauthenticated attackers to cause a Denial of Service (DoS) by blocking the single-threaded Node.js event loop.\n\n## TL;DR\nThe brace-expansion JavaScript library suffers from an O(N^2) quadratic complexity vulnerability when parsing legacy {a},b}-shaped structures with many trailing braces. This allows remote attackers to trigger a Denial of Service by blocking the single-threaded Node.js event loop.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-407\n- **Attack Vector**: Network (Remote)\n- **CVSS v3.1 Score**: 5.3\n- **EPSS Score**: 0.00301\n- **Impact**: Availability (Denial of Service)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing brace-expansion in Node.js environments for path or glob matching\n- Downstream packages like minimatch and glob utilizing vulnerable versions of brace-expansion\n- **brace-expansion**: < 1.1.21 (Fixed in: `1.1.21`)\n- **brace-expansion**: >= 2.0.0, < 2.1.7 (Fixed in: `2.1.7`)\n- **brace-expansion**: >= 3.0.0, < 3.0.9 (Fixed in: `3.0.9`)\n- **brace-expansion**: >= 4.0.0, < 5.0.12 (Fixed in: `5.0.12`)\n\n## Mitigation\n\n- Upgrade the brace-expansion package to a patched release version\n- Sanitize user inputs to reject strings containing excessive consecutive brackets\n- Implement edge WAF filtering rules to drop payloads matching patterns of excessive trailing braces\n\n**Remediation Steps:**\n1. Locate instances of the brace-expansion library within the software dependency tree using npm audit or yarn audit.\n2. Force update the dependency to version 1.1.21, 2.1.7, 3.0.9, or 5.0.12 depending on the major version branch in use.\n3. In corporate environments where direct dependency upgrades are delayed, apply a regular expression filter at the application gateway to reject patterns like '\\{[^}]+\\}[}]{10,}.*,'.\n\n## References\n\n- [GitHub Security Advisory (GHSA-q2hr-2g5m-vwhr)](https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr)\n- [NVD Vulnerability Details Page](https://nvd.nist.gov/vuln/detail/CVE-2026-102277)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-102277)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-102277) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T08:30:31.000000Z"}