{"action":"Upgrade brace-expansion to 1.1.21 or later.","affected":[{"fixed":"5.0.12","introduced":"4.0.0"},{"fixed":"3.0.9","introduced":"3.0.0"},{"fixed":"2.1.7","introduced":"2.0.0"},{"fixed":"1.1.21","introduced":"0"}],"component":"brace-expansion","cve_ids":["CVE-2026-102277"],"ecosystem":"npm","epss":0.00428,"exploited":false,"fixed_versions":["5.0.12","3.0.9","2.1.7","1.1.21"],"ghsa_id":"GHSA-q2hr-2g5m-vwhr","id":"tcs_01M5KG4VA57W52T7BWP1GV4MEN","modified_at":"2026-09-30T00:00:03.849541183Z","published_at":"2026-09-29T23:45:39Z","references":["https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-q2hr-2g5m-vwhr","url":"https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr"}],"summary":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service"}