AIKIDO-2026-237551

TL;DR

brace-expansion expands shell-style brace patterns through a recursive expand_ function that computes the post segment unconditionally before the early-return branches that discard it. An input containing many consecutive non-expanding {} groups forces each recursion level to expand the remaining tail twice, producing exponential-time behavior in the number of groups. A short pattern of roughly ninety bytes blocks the single-threaded event loop for minutes, the max option does not bound this work, and untrusted input reaching expand() directly or through minimatch/glob can stall a worker or process. The fix defers computing post until a brace set actually expands and converts the rewrite step from recursion into an in-function loop.