CVE-2026-102276 · GHSA-6j4f-fj2g-mc7p

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Risk score: 66/100
CVSS: 7.5 v3.1
Exploit chance (30 days): 0.4%
Published: 28 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass e…
Affected: brace-expansion (npm) >= 4.0.0, < 5.0.10; brace-expansion (npm) >= 3.0.0, < 3.0.7; brace-expansion (npm) >= 2.0.0, < 2.1.5; brace-expansion (npm) < 1.1.19
Fix: Upgrade brace-expansion to 5.0.10 or 3.0.7 or 2.1.5 or 1.1.19 (whichever matches your release line) or later.
Exploitation: Public proof of concept

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

brace-expansion: Amber, patch this week. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass e…

The flaws

CVE-2026-102276: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (CVSS 7.5 · EPSS 0%)
CVE-2026-102278: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (CVSS 7.5 · EPSS 0%)
CVE-2026-102277: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service (CVSS 5.3 · EPSS 0%)

The fix

Upgrade brace-expansion: 1.1.19 · 2.1.5 · 3.0.7 · 5.0.10 · 1.1.20 · 2.1.6 or later on your release line

Who is exposed: brace-expansion (npm) >= 4.0.0, < 5.0.10; brace-expansion (npm) >= 3.0.0, < 3.0.7; brace-expansion (npm) >= 2.0.0, < 2.1.5; brace-expansion (npm) < 1.1.19

Where it stands

Public proof of concept

Connects to

Same weakness: Denial of service (CWE-400). 251 other warnings in 30 days

Why it is Amber

CVSS 7.5 high
Public exploit or proof of concept referenced
Remotely exploitable without logging in
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
brace-expansion	npm	>= 4.0.0, < 5.0.10	5.0.10
brace-expansion	npm	>= 3.0.0, < 3.0.7	3.0.7
brace-expansion	npm	>= 2.0.0, < 2.1.5	2.1.5
brace-expansion	npm	< 1.1.19	1.1.19

References

Original description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Last activity 28 Sep 2026. Patch Forecast updates every hour.