The vulnerability, CVE-2026-102277, is a Regular Expression Denial of Service (ReDoS) in the brace-expansion library. It stems from a quadratic-time complexity issue in the parsing logic when handling specific brace group patterns, specifically {a},b}. The parser attempts to expand such patterns by rewriting the string and restarting the scan. Each rewrite consumes one closing brace (}) and re-scans the entire string. For an input like {a}}...},z} with 'n' trailing braces, this process results in 'n' full passes over a string that also grows in length with each pass due to the insertion of a sentinel (escClose). This leads to a quadratic time complexity (O(n^2)) and significant memory inflation, causing the event loop to block for extended periods.
The identified vulnerable functions are expand (in newer versions, e.g., brace-expansion@5.x, brace-expansion@2.x, brace-expansion@3.x) and expandTop (in older versions, e.g., brace-expansion@1.x), along with the internal recursive expand or expand_ function. These functions are responsible for processing the input string and performing the brace expansion. The core vulnerability lies within the while loop inside the expand (or expand_) function, where the string rewriting and re-scanning occurs without an adequate bound on the number of iterations. The patches introduce a maxRewrites option and a counter (rewrites) to limit the number of times this rewrite loop can execute, thus preventing the quadratic behavior and mitigating the DoS. An attacker could provide a specially crafted input string to these functions, causing them to consume excessive CPU resources and block the application's event loop.
Miggo AI
