Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| juliangruber | brace-expansion | >= 4.0.0, < 5.0.12, >= 3.0.0, < 3.0.9, >= 2.0.0, < 2.1.7, < 1.1.21 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-brace-expansion | 2.1.7+~1.1.2-1 | — |
| Debian 13 | node-brace-expansion | No fix yet | — |
| Debian 12 | node-brace-expansion | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-brace-expansion | No fix yet | — |
| Ubuntu 26.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 24.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 22.04 LTS | node-brace-expansion | No fix yet | — |
| Ubuntu 20.04 LTS | node-brace-expansion | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | node-brace-expansion | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | nodejs +4 | 1:24.22.1-3.module+el9.8.0+25216+afa2a4a4 | RHSA-2026:92378 |
| RHEL 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+24708+e71d2e1d | RHSA-2026:92378 |
| RHEL 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+24708+e71d2e1d | RHSA-2026:92378 |
| RHEL 9 | npm | 1:11.19.1-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4 | RHSA-2026:92378 |
| RHEL 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module+el9.8.0+25216+afa2a4a4 | RHSA-2026:92378 |
| RHEL 8 | nodejs +4 | 1:24.22.1-1.module+el8.10.0+25218+d9e131cb | RHSA-2026:92376 |
| RHEL 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+24711+b610b202 | RHSA-2026:92376 |
| RHEL 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+24711+b610b202 | RHSA-2026:92376 |
| RHEL 8 | npm | 1:11.19.1-1.24.22.1.1.module+el8.10.0+25218+d9e131cb | RHSA-2026:92376 |
| RHEL 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module+el8.10.0+25218+d9e131cb | RHSA-2026:92376 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | nodejs22 +6 | 1:22.23.3-2.3.2.2.hum1 | RHSA-2026:74161 |
| Red Hat Hardened Images 1 | nodejs22-npm | 1:10.9.9-1.22.23.3.2.3.2.2.hum1 | RHSA-2026:74161 |
| Red Hat Hardened Images 1 | nodejs24 +5 | 1:24.21.0-1.2.hum1 | RHSA-2026:74167 |
| Red Hat Hardened Images 1 | nodejs24-npm +1 | 2:11.19.0-1.24.21.0.1.2.hum1 | RHSA-2026:74167 |
| Red Hat Hardened Images 1 | nodejs26 +6 | 1:26.10.0-0.3.hum1 | RHSA-2026:74168 |
| Red Hat Hardened Images 1 | nodejs26-npm | 1:11.19.1-1.26.10.0.0.3.hum1 | RHSA-2026:74168 |
| Red Hat Hardened Images 1 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.2.hum1 | RHSA-2026:74167 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | nodejs +4 | 1:24.22.1-3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-nodemon | 3.1.14-3.module_el9.8.0+292+f4eaf8b2 | ALSA-2026:92378 |
| AlmaLinux 9 | nodejs-packaging +1 | 2021.06-6.module_el9.7.0+209+ecf6523e | ALSA-2026:92378 |
| AlmaLinux 9 | npm | 1:11.19.1-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.3.module_el9.8.0+333+788f3075 | ALSA-2026:92378 |
| AlmaLinux 8 | nodejs +4 | 1:24.22.1-1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4250+09238ed4 | ALSA-2026:92376 |
| AlmaLinux 8 | nodejs-packaging +1 | 2021.06-6.module_el8.10.0+4086+70facd4a | ALSA-2026:92376 |
| AlmaLinux 8 | npm | 1:11.19.1-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
| AlmaLinux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.22.1.1.module_el8.10.0+4331+0683c9c1 | ALSA-2026:92376 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | nodejs | 1:24.22.1-3.module+el9.8.0+40401+e24b8c95 | RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+40281+14cc6568 | RLSA-2026:92378 |
| Rocky Linux 9 | nodejs-packaging | 2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:92378 |
| Rocky Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:92376 |
| Rocky Linux 8 | nodejs-packaging | 2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:92376 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 25+475.275dd4727-56.1 | openSUSE-SU-2026:12424-1 |
| openSUSE Tumbleweed | pi-coding-agent | 1.0.0-1.1 | openSUSE-SU-2026:11967-1 |
| openSUSE Leap 16.0 | pi-coding-agent | 1.0.4-bp160.1.1 | openSUSE-SU-2026:22111-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | js-jquery +2 | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | nodejs +4 | 1:24.21.0-1.0.1.module+el9.8.0+91091+c060d8b4 | ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-nodemon | 3.1.14-3.module+el9.8.0+91009+5d530ccd | ELSA-2026-92378 |
| Oracle Linux 9 | nodejs-packaging +1 | 2021.06-6.module+el9.8.0+91009+5d530ccd | ELSA-2026-92378 |
| Oracle Linux 9 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4 | ELSA-2026-92378 |
| Oracle Linux 9 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el9.8.0+91091+c060d8b4 | ELSA-2026-92378 |
| Oracle Linux 8 | nodejs +4 | 1:24.21.0-1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-nodemon | 3.1.14-2.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | nodejs-packaging +1 | 2021.06-6.module+el8.10.0+91054+4b1a799c | ELSA-2026-92376 |
| Oracle Linux 8 | npm | 1:11.19.0-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
| Oracle Linux 8 | v8-13.6-devel | 3:13.6.233.17-1.24.21.0.1.0.1.module+el8.10.0+91090+8c7726c5 | ELSA-2026-92376 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | lerna | 10.0.1-r6 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.9-r1 | — |
| Wolfi rolling | npm-12 | 12.2.0-r1 | — |
| Wolfi rolling | opensearch-dashboards-3 +5 | 3.8.0-r9 | — |
| Wolfi rolling | prism | 5.16.0-r14 | — |
| Wolfi rolling | rancher-api-ui | 1.2.3-r13 | — |
| Wolfi rolling | renovate | 44.133.0-r1 | — |
| Wolfi rolling | sqlpad | 7.5.7-r44 | — |
| Wolfi rolling | ts-patch | 4.0.1-r46 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | brace-expansion | >= 4.0.0, < 5.0.12 | 5.0.12 | GHSA-q2hr-2g5m-vwhr |
| npm | brace-expansion | >= 3.0.0, < 3.0.9 | 3.0.9 | GHSA-q2hr-2g5m-vwhr |
| npm | brace-expansion | >= 2.0.0, < 2.1.7 | 2.1.7 | GHSA-q2hr-2g5m-vwhr |
| npm | brace-expansion | < 1.1.21 | 1.1.21 | GHSA-q2hr-2g5m-vwhr |
Advisories 14
- RHSA-2026:92376 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92378 Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74161 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74167 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:74168 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- openSUSE-SU-2026:12424-1 agama-web-ui-25+475.275dd4727-56.1 on GA media SUSE / openSUSE Security Updates · Nov 6, 2026
- RLSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- RLSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update Rocky Linux Security Advisories · Oct 30, 2026
- ELSA-2026-92378 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ELSA-2026-92376 Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Oct 30, 2026
- ALSA-2026:92378 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:92376 Important: nodejs:24 security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:22111-1 Security update for pi-coding-agent SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:11967-1 pi-coding-agent-1.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 3, 2026
References
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
- https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96
- https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22
- https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364
- https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e