CVE-2026-102277

npm/brace-expansion CVE-2026-102277: medium 5.3, EPSS 0.30%

brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Action: Upgrade brace-expansion to 1.1.21 or later.

npm i brace-expansion@5.0.12

npm i brace-expansion@3.0.9

npm i brace-expansion@2.1.7

npm i brace-expansion@1.1.21

Affected

Fixed versions

Sources

• osv: GHSA-q2hr-2g5m-vwhr
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
• https://nvd.nist.gov/vuln/detail/CVE-2026-102277
• https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96
• https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22
• https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364
• https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e
• https://github.com/juliangruber/brace-expansion

CVE-2026-102277 · published 2026-09-29T23:45:39Z · modified 2026-09-30T00:00:03.849541183Z · JSON