CVE-2026-102277

About vulnerability

Summary

Expanding {a},b}-shaped input takes time quadratic in the number of literal } characters, blocking the event loop.

Bash preserves a quirk where a brace group followed by a comma set still expands ({a},b}). The parser implements this by rewriting the string and restarting the scan. Each pass absorbs exactly one } and re-scans from the beginning, so n trailing braces cost n full passes.

Reproduction

const build = n => '{a}' + '}'.repeat(n) + ',z}'

for (const n of [8000, 16000, 32000, 64000, 128000]) {
const t = Date.now()
expand(build(n))
console.log(n, Date.now() - t + 'ms')
}

ms/n^2 is flat at ~1.7 and each doubling of n costs exactly 4.0x - quadratic. 128 KB of input blocks the event loop for nearly half a minute to produce two results.

Mechanism

Instrumenting the rewrite branch confirms it runs exactly n + 1 times, once per literal }, each re-scanning the whole string.

There is a second multiplier. The rewrite replaces the group’s closing } with the internal escClose sentinel, which is '\0CLOSE' + Math.random() + '\0' - about 25 characters. The working string therefore grows by ~25 characters on every pass:

So the input is inflated roughly 26x, and that factor multiplies both the quadratic constant and peak memory. This makes it partly a memory-pressure issue as well as a CPU one.

Why max and maxLength do not help

The cost is in parsing, before the result set exists. The payload yields 2 results regardless of size, so neither bound is ever reached.

Impact

An application passing an untrusted pattern to expand(), directly or through minimatch / glob, can have its event loop blocked for tens of seconds by a payload well under minimatch’s 65,536-character cap. For a single-threaded Node server that is a full stall, not just a slow request.

Degraded availability rather than a crash - the process recovers once the expansion completes.

Affected versions

Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, all within a few percent of each other (~460-490 ms at n=16,000).

Patch

The rewrite loop gets an iteration bound. Past the cap the remaining string is treated as non-expanding and returned literally, consistent with the existing max / maxLength caps, which truncate rather than throw.

Note this bounds the number of passes, not the cost of each: worst-case work remains proportional to cap x input length. The cap is set low enough that the residual is bounded in practice, and far above what any realistic {a},b} input needs.

Severity note

Scored 5.3 Medium (A:L) for consistency with GHSA-3jxr-9vmj-r5cp, the other algorithmic-complexity advisory on this package (CWE-407), which uses the same vector. The stack-exhaustion advisories on this package score A:H because they crash the process outright; this one stalls it.

Affected product:

Node.js , aegir , ai-sdk-harness-pi , archiver-utils , asciidoctor-core , asciidoctor-opal-runtime , asciidoctor.js , async-disk-cache , aws-cdk , babel-jest , babel-plugin-istanbul , beasties , beasties-webpack-plugin , brace-expansion , broccoli-funnel , broccoli-kitchen-sink-helpers , broccoli-sane-watcher , bunyan , bunyan-debug-stream , bunyan-gke-stackdriver , c8 , cacache , cdk-nag , cdk-serverless-clamscan , commit-analyzer , commoner , config-array , copy-concurrently , cpr , create-jest , create-medplum , del , earendil-works-chord , earendil-works-pi-agent-core , earendil-works-pi-ai , earendil-works-pi-client , earendil-works-pi-server , editorconfig-core-js , ejs , file-utils , filelist , findup-sync , fireworm , fs-jetpack , fs-vacuum , fstream , fstream-ignore , fstream-npm , gaze , gear , gh-pages , github , glob , glob-stream , globby , iarna-cli , ignore-walk , init-package-json , istanbul , istanbul-lib-processinfo , it , jake , jasmine-npm , jest , jest-circus , jest-cli , jest-config , jest-core , jest-docblock , jest-environment , jest-environment-jsdom , jest-environment-node , jest-expect , jest-fake-timers , jest-globals , jest-haste-map , jest-jasmine2 , jest-matcher-utils , jest-message-util , jest-mock , jest-reporters , jest-resolve-dependencies , jest-runner , jest-runtime , jest-snapshot , jest-test-sequencer , jest-transform , jest-util , jest-validate , js-ipfs-utils , jslint , lerna , libnpmdiff , libnpmexec , libnpmfund , libnpmorg , libnpmversion , libp2p-interface-compliance-tests , libp2p-interop , liftoff , lock-verify , make-fetch-happen , matcher-collection , medplum , medplum-agent , medplum-app , medplum-bot-layer , medplum-ccda , medplum-cdk , medplum-cli , medplum-core , medplum-definitions , medplum-dosespot-core , medplum-dosespot-react , medplum-eslint-config , medplum-fhir-router , medplum-fhirtypes , medplum-health-gorilla-core , medplum-health-gorilla-react , medplum-hl7 , medplum-mock , medplum-react , medplum-react-hooks , medplum-react-scheduling , medplum-scriptsure-react , metalsmith , minimatch , move-concurrently , multimatch , npm , npm-packlist , npm-profile , npm-registry-fetch , npm:libnpmpack , npmcli-arborist , npmcli-config , npmcli-map-workspaces , npmcli-metavuln-calculator , npmcli-package-json , nx , nx-devkit , nyc , oclif-plugin-plugins , offline-plugin , package-json , pacote , parcel-fs , parcel-utils , pi , postcss-url , qunit , recursive-readdir , release-notes-generator , resp-modifier , rewrite , rimraf , run-script , sander , sane , sauce-connect-launcher , semantic-release , semantic-release-changelog , semantic-release-git , semantic-release-monorepo , semantic-release-npm , semantic-release-plugin-decorators , sigstore-js , sorcery , spawn-wrap , static-config , stylus , sucrase , tar-pack , test-exclude , tmp , true-case-path , ts-morph , tuf-js , turbo-codemod , turborepo , typedoc , typedoc-plugin-coverage , typedoc-plugin-markdown , typescript-eslint-typescript-estree , unzipper , urltools , vinyl-fs , vite-plugin-beasties , watch-detector , web-rollup-plugin-copy , web-rollup-plugin-html , webdav , wireit , yaml.js

Affected packages:

brace-expansion @ 2.0.1 (+611 more)