GHSA-Q2HR-2G5M-VWHR brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

Summary Expanding a,b-shaped input takes time quadratic in the number of literal characters, blocking the event loop. Bash preserves a quirk where a brace group followed by a comma set still expands a,b. The parser implements this by rewriting the string and restarting the scan. Each pass absorbs...

CVE-2026-102277

The brace-expansion library is vulnerable to a recoverable CPU denial of service due to how the expand function processes specific patterns. Prior to versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12 , providing untrusted {a},b}-shaped patterns with numerous trailing closing braces causes the library to ...

CVE-2026-102277 brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted a,b-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The...