CVE-2026-102277: Denial of Service via Quadratic Algorithmic Complexity in brace-expansion

The brace-expansion JavaScript library is a widely utilized package designed to perform shell-like brace expansion, mirroring the behavior found in shells such as sh and bash. It is a foundational utility used extensively in pattern matching and file expansion within Node.js ecosystems, often serving as a dependency for libraries like minimatch and glob.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-407 (Inefficient Algorithmic Complexity). It manifests when the parser attempts to resolve a legacy compatibility quirk. When processing a specific structure containing a sequence of trailing closing braces and a trailing comma set, the parsing state machine falls back to an inefficient iterative rewriting scheme.

An attacker capable of submitting arbitrary strings to any application interface that processes inputs via brace-expansion can exploit this flaw. Because Node.js is single-threaded, blocking the event loop with this computationally intensive processing loop prevents the runtime from handling concurrent network connections, leading to application-wide denial of service.

Bash retains a legacy behavior where a brace group followed by a comma set expansions despite not forming a standard option or sequence set. For example, the expression {a},b} expands into a} and b. To replicate this quirk, the brace-expansion parser identifies potential {a},b}-shaped patterns, performs an in-place string modification, and restarts the scanner loop from the beginning of the string.

When an attacker provides a payload consisting of a single valid brace group, followed by a large number of trailing closing braces, and a terminating comma set (such as '{a}' + '}'.repeat(N) + ',z}'), the parser becomes trapped in a recursive-like loop. On the first pass, the parser detects the group {a}. Because the substring after this group contains a comma and a closing brace, it matches the legacy pattern, replaces the first closing brace with an escaped sentinel string (escClose), and restarts the scan.

On the subsequent pass, the parser scans from the beginning. It bypasses the previously escaped brace and treats the next literal trailing closing brace as the group terminator. This second brace is rewritten, and the scan restarts again. This process repeats for every single trailing closing brace in the input string.

This behavior has severe performance implications. For an input with N trailing braces, the parser performs N complete rescans of the entire string, resulting in quadratic time complexity ($O(N^2)$). Furthermore, because each rewrite replaces a single-byte closing brace with a multi-byte escClose sentinel string (approximately 25 characters), the size of the processing string expands linearly, creating significant heap allocation overhead and garbage collection pressure.

The vulnerability lies within the core parsing routine, specifically inside the nested matching loop. Before the patch, the parser evaluated the legacy Bash pattern and triggered an unrestricted continuation loop without tracking iteration depth or frequency.

// Vulnerable code pattern
const isOptions = m.body.indexOf(',') >= 0
if (!isSequence && !isOptions) {
  // Pattern identified as {a},b}
  if (m.post.match(/,(?!,).*\}/)) {
    str = m.pre + '{' + m.body + escClose + m.post
    isTop = true
    continue // Scan is restarted from the beginning without a limit
  }
}

The official remediation introduces EXPANSION_MAX_REWRITES to bound the scan restarts. Below is the annotated patched code structure demonstrating the restriction placed on loop iterations:

// Patched code pattern
export const EXPANSION_MAX_REWRITES = 1000
 
function expand (str, max, maxLength, maxDepth, depth, maxRewrites, isTop) {
  let rewrites = 0
  
  // ... inner parser loop ...
  
    const isOptions = m.body.indexOf(',') >= 0
    if (!isSequence && !isOptions) {
      // Check the rewrite limit before attempting legacy modification
      if (rewrites < maxRewrites && m.post.match(/,(?!,).*\}/)) {
        rewrites++
        str = m.pre + '{' + m.body + escClose + m.post
        isTop = true
        continue // Restarts scan, but capped at 1000 iterations
      }
    }

By capping the iteration count, the parser prevents unbounded execution on malicious inputs. Once the threshold of 1000 rewrites is exceeded, the parser ceases rewriting, exits the loop, and processes the remaining segment as a literal string.

To exploit this vulnerability, an attacker must submit a structured payload containing a leading simple brace group, a high count of consecutive closing braces, and a final comma set. Because the payload relies solely on common characters, it easily bypasses standard sanitization mechanisms that only look for malicious command sequences or script tags.

const expand = require('brace-expansion');
 
// Construct a payload containing 80,000 trailing braces
const n = 80000;
const payload = '{a}' + '}'.repeat(n) + ',z}';
 
console.log(`[+] Running expansion with ${n} trailing braces...`);
const startTime = performance.now();
 
// Trigger the vulnerable parsing loop
const result = expand(payload);
 
const endTime = performance.now();
console.log(`[+] Completed in ${(endTime - startTime).toFixed(2)} ms`);

When executed on an unpatched environment, the single-threaded Node.js event loop blocks entirely. During this execution window, the application is unable to process incoming requests, complete asynchronous database queries, or respond to health check probes. This leads to connection timeouts and service unresponsiveness.

The mitigation successfully blocks the infinite rewriting path by enforcing EXPANSION_MAX_REWRITES = 1000. However, security engineers should consider the architectural implications of how the state is tracked.

The rewrites variable is scoped locally within each execution context of the recursive expand function. When processing nested expansion sequences, each nested call receives its own independent allocation of 1000 rewrites. An attacker can theoretically design a multi-layered nested structure to bypass the 1000-rewrite ceiling globally, though the total impact is bounded by the separate EXPANSION_MAX_DEPTH (1000) and EXPANSION_MAX_LENGTH (4,000,000) limits.

Another residual behavior is that when the rewrite limit is reached, the library silently stops expanding and treats the remaining portion literally. If downstream components expect fully expanded arrays for access control or command parsing, this behavior can introduce parser differential issues where the application logic processes the literal string representation differently than intended.

The primary remediation step is to upgrade the brace-expansion dependency to a safe release version. The fix has been backported across all active branches to maintain backward compatibility.

# Verify dependency status and upgrade paths
npm audit
 
# Upgrade brace-expansion to the latest patched version
npm install brace-expansion@latest

If immediate dependency updates are not possible, deploy a Web Application Firewall (WAF) rule to block incoming request parameters containing repetitive closing braces. The following pattern matches payloads trying to exploit this behavior:

\{[^}]+\}[}]{10,}.*,

This regex detects the necessary sequence of a valid brace group, followed by ten or more consecutive closing braces, followed by a trailing comma, allowing security teams to drop matching requests at the edge.