brace-expansion EUVD-2026-88551

Exploitation requires that the application pass attacker-controlled input to brace-expansion's expand() function - either directly or transitively via consumers like minimatch/glob - and that this input reach the expander unbounded. The specific trigger is a {a},b}-shaped pattern with a large number of trailing closing braces (e.g. '{a}' + '}'.repeat(n) + ',z}'); the parser restarts its full scan once per trailing brace, producing quadratic CPU and memory cost. Limiting factors: many applications never feed untrusted data into brace expansion (patterns are usually developer-supplied globs), the DoS is recoverable rather than permanent, and vanilla output-size guards (max/maxLength) do NOT bound it because the cost is entirely in parsing before output. Node.js runtime only.

This is a genuine but low-severity issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: network-reachable, no privileges, no user interaction, but only a limited availability impact (A:L) because the description explicitly states the process 'eventually recovers' - this is a recoverable CPU/memory denial of service, not a crash or resource-exhaustion kill. I agree with the 5.3 and A:L rating. There is no EPSS score, no CISA KEV listing, and no public exploit code provided (the advisory ships regression tests, not a weaponized POC), so exploitation status is 'no public exploit identified at time of analysis.' The signals are not conflicting: a moderate CVSS with only availability impact and no exploitation evidence points to a low real-world priority. The mitigating reality is that the trigger is narrow - an attacker must be able to feed a specifically-shaped {a},b} pattern with many trailing closing braces into brace-expansion, which most applications never expose to untrusted input.

An application passes untrusted, attacker-controlled input to brace-expansion (directly or via a dependent such as minimatch/glob) and expands it. The attacker submits a pattern shaped like '{a}' + '}'.repeat(128000) + ',z}'; the parser restarts its full scan once per trailing brace over a working string that grows each pass, consuming quadratic CPU/memory - the advisory measured ~27 seconds of blocked event loop for a 128KB payload. No public exploit code exists, only regression tests demonstrating the timing.