CVE-2026-102277

Summary

Expanding {a},b}-shaped input takes time quadratic in the number of literal } characters, blocking the event loop.

Bash preserves a quirk where a brace group followed by a comma set still expands ({a},b}). The parser implements this by rewriting the string and restarting the scan. Each pass absorbs exactly one } and re-scans from the beginning, so n trailing braces cost n full passes.

Reproduction

const build = n => '{a}' + '}'.repeat(n) + ',z}'

for (const n of [8000, 16000, 32000, 64000, 128000]) {
  const t = Date.now()
  expand(build(n))
  console.log(n, Date.now() - t + 'ms')
}

| n | input | time | results | |---|---|---|---| | 8,000 | 8 KB | 110 ms | 2 | | 16,000 | 16 KB | 446 ms | 2 | | 32,000 | 32 KB | 1.7 s | 2 | | 64,000 | 64 KB | 6.9 s | 2 | | 128,000 | 128 KB | 27.7 s | 2 |

ms/n^2 is flat at ~1.7 and each doubling of n costs exactly 4.0x - quadratic. 128 KB of input blocks the event loop for nearly half a minute to produce two results.

Mechanism

Instrumenting the rewrite branch confirms it runs exactly n + 1 times, once per literal }, each re-scanning the whole string.

There is a second multiplier. The rewrite replaces the group's closing } with the internal escClose sentinel, which is '\0CLOSE' + Math.random() + '\0' - about 25 characters. The working string therefore grows by ~25 characters on every pass:

| n | input length | final string length | |---|---|---| | 1,000 | 1,006 | 26,006 | | 8,000 | 8,006 | 208,006 |

So the input is inflated roughly 26x, and that factor multiplies both the quadratic constant and peak memory. This makes it partly a memory-pressure issue as well as a CPU one.

Why max and maxLength do not help

The cost is in parsing, before the result set exists. The payload yields 2 results regardless of size, so neither bound is ever reached.

Impact

An application passing an untrusted pattern to expand(), directly or through minimatch / glob, can have its event loop blocked for tens of seconds by a payload well under minimatch's 65,536-character cap. For a single-threaded Node server that is a full stall, not just a slow request.

Degraded availability rather than a crash - the process recovers once the expansion completes.

Affected versions

Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, all within a few percent of each other (~460-490 ms at n=16,000).

Patch

The rewrite loop gets an iteration bound. Past the cap the remaining string is treated as non-expanding and returned literally, consistent with the existing max / maxLength caps, which truncate rather than throw.

Note this bounds the number of passes, not the cost of each: worst-case work remains proportional to cap x input length. The cap is set low enough that the residual is bounded in practice, and far above what any realistic {a},b} input needs.

Severity note

Scored 5.3 Medium (A:L) for consistency with GHSA-3jxr-9vmj-r5cp, the other algorithmic-complexity advisory on this package (CWE-407), which uses the same vector. The stack-exhaustion advisories on this package score A:H because they crash the process outright; this one stalls it.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:Rocky Linux-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)

• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)

• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)

• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)

• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)

• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)

• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)

• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)

• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)

• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)

• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)

• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)

• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:Rocky Linux-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-8] (JIRA:RHEL-289763)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

Security Fix(es):

• ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing (CVE-2026-101911)
• brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278)
• brace-expansion: brace-expansion: Denial of Service via crafted brace patterns (CVE-2026-102277)
• brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276)
• brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
• nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)
• nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069)
• nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482)
• nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
• nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
• nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
• nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync() (CVE-2026-106073)
• nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)

Bug Fix(es) and Enhancement(s):

• nodejs:24/nodejs: Rebase to the latest Node.js 24 release [rhel-9.8.z] (JIRA:RHEL-293233)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.20-tuxcare.1.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.18-tuxcare.2.

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 4.0.1-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.0.2-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.16-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.15-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.14-tuxcare.2.

TuxCare rebuilt brace-expansion to address 3 CVEs. Fixed in 2.0.1-tuxcare.4.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.6-tuxcare.1.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.11-tuxcare.1.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.10-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.4-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.3-tuxcare.3.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.9-tuxcare.3.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 2.1.2-tuxcare.4.

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.11-tuxcare.3.

TuxCare rebuilt brace-expansion to address 2 CVEs. Fixed in 5.0.4-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 5.0.8-tuxcare.4.

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.5-tuxcare.2.

TuxCare rebuilt brace-expansion to address 4 CVEs. Fixed in 1.1.12-tuxcare.5.

TuxCare rebuilt brace-expansion to address 6 CVEs. Fixed in 5.0.6-tuxcare.1.

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.3-tuxcare.1.

TuxCare rebuilt brace-expansion to address 7 CVEs. Fixed in 5.0.2-tuxcare.1.

TuxCare rebuilt brace-expansion to address 5 CVEs. Fixed in 1.1.3-tuxcare.2.

TuxCare rebuilt brace-expansion to address 1 CVE. Fixed in 1.1.1-tuxcare.2.

These are all security issues fixed in the pi-coding-agent-1.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-web-ui-25+475.275dd4727-56.1 package on the GA media of openSUSE Tumbleweed.

This update for pi-coding-agent fixes the following issues:

Changes in pi-coding-agent:

• Update to version 1.0.4 (1.0.3 was superseded the same day and never submitted):

  • BREAKING: provider azure-openai-responses renamed to azure, now also serving Azure Foundry Chat Completions (azure/deepseek-v4-pro first). Rename the provider key in auth.json (or run /login again), models.json and settings.json (defaultProvider, enabledModels and modelThinkingLevels); sessions on the old provider fall back and lose prompt cache. AZURE_OPENAI_* env vars unchanged
  • --tools and --exclude-tools take *-patterns and --no-mcp disables MCP for one run; --tools keeps MCP tools unless an entry starts with mcp__
  • Codemode read() on image files yields an image block image() shows, and image() also saves each image to a temp file for later turns
  • Fix fenced-code highlighting past the first line, MCP OAuth native-client registration, MCP shutdown racing a connecting server, Bedrock stalled-stream retries and frozen codemode built-ins, plus ChatGPT-login, EIO-on-closed-terminal and output-file-permission fixes
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules 1.0.2 -> 1.0.4: the ten @earendil-works packages move to 1.0.4; nanoid, postcss and vite move too but are dev-only and not shipped. Still 119 shipped modules and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it
  • CVE-2026-102277 (boo#1283392) and CVE-2026-102278 (boo#1283412): brace-expansion is 5.0.12, at the 5.0.12 and above the 5.0.11 fix floors, so the package is not affected by them

• Update to version 1.0.2: patch releases on the 1.0 API, with no breaking changes

  • models.json takes samplingParamsByThinkingLevel next to the existing samplingParams, so an OpenAI-compatible model can set temperature, top_p and the like separately for off, minimal, low, medium, high, xhigh and max. Model defaults, the effective level's override and the request are merged per key, modelOverrides merges per level, and the levels are pi's own, not the provider's thinkingLevelMap values. Only openai-completions, openai-responses and azure-openai-responses apply them
  • MCP servers can be enabled, disabled or re-scoped per project from a .pi/mcp.json entry without a command or url, and /mcp toggles a user-level server for the current project
  • oauth.clientRegistration: "cimd" identifies pi by its Client ID Metadata Document instead of dynamic client registration
  • pi.registerToolRenderer() picks how calls to a tool that is not registered yet are drawn, such as MCP tools in a resumed session
  • Cloudflare's Clef and Clef Flash classifier models are usable from codemode scripts and extensions
  • A codemode script printing in a loop now fails at 16 Mi characters or 100000 items instead of running pi out of memory
  • MCP tool calls in resumed sessions and HTML exports no longer render fully expanded until their server connects
  • JPEG, GIF and WebP images that extensions draw through Image now appear in Kitty, Ghostty, WezTerm and Warp, and fullscreen Kitty images no longer collapse to a one-row strip after scrolling in WezTerm
  • Many more fixes and improvements; see upstream's release notes for the full list

• Refresh the vendored node_modules over 1.0.0 -> 1.0.2: the ten @earendil-works packages move to 1.0.2, with pi-telemetry the one that was already at 1.0.2 in the 1.0.1 tree, plus @anthropic-ai/sdk to 0.129.0. No module leaves or joins the 119 shipped ones and the licence union is unchanged

  • CVE-2026-102276 (boo#1283188): brace-expansion is 5.0.12, above the 5.0.10 fix floor, so the package is not affected by it. Upstream's 1.0.1 made…