CVE-2026-102277

A moderate-impact denial of service vulnerability was found in brace-expansion, an npm package bundled as a dependency in a large number of Red Hat products that ship Node.js-based components. When an application passes attacker-controlled input to the expand function, a remote unauthenticated attacker can supply a crafted {a},b}-shaped pattern containing many trailing closing braces. The parser rewrites the string and restarts its scan once for each trailing closing brace, and every pass rescans the entire input, resulting in quadratic CPU time and memory consumption. This can block the Node.js event loop of the affected process and temporarily disrupt application availability; the process recovers once the expansion completes, making this a recoverable CPU denial of service with no impact on confidentiality or integrity. The large majority of Red Hat product streams that ship a bundled copy of brace-expansion are affected; a small number of shipped components are marked not affected because the vulnerable code is not present in the shipped version or because those components do not include brace-expansion. For most affected streams the fix is deferred to a routine future component update, since the flaw is a recoverable, availability-only denial of service of low severity; the residual risk of deferral is temporary CPU and memory pressure and event-loop blocking when an attacker is able to supply crafted brace patterns to an affected application's expansion call. For streams where remediation is delegated, the maintainers of the bundled component are pursuing a fix, and a small number of streams have already shipped an update that remediates the issue. The Red Hat severity of MODERATE (CVSS 3.1 score 5.3, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) is consistent with the upstream assessment, so there is no meaningful difference from upstream severity.