The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many
    trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-
    input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can
    block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial
    of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. (CVE-2026-102277)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to     1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many     trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-     input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can     block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial     of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12. (CVE-2026-102277)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461308	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461308	Echo: node-brace-expansion: security update to 2.0.1+~1.1.0-2+e4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
351359	Linux Distros Unpatched Vulnerability : CVE-2026-102277	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-102277

medium

Tenable Plugins

medium

medium

medium