CVE-2026-102278 · GHSA-qhr7-859c-m2p7
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
- Risk score
- 60/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can app…
- Affected
- brace-expansion (npm) >= 4.0.0, < 5.0.11; brace-expansion (npm) >= 3.0.0, < 3.0.8; brace-expansion (npm) >= 2.0.0, < 2.1.6; brace-expansion (npm) < 1.1.20
- Fix
- Upgrade brace-expansion to 5.0.11 or 3.0.8 or 2.1.6 or 1.1.20 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
brace-expansion: Amber, patch this week. The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass e…
The flaws
- CVE-2026-102278: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion (CVSS 7.5 · EPSS 0%)
- CVE-2026-102276: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion (CVSS 7.5 · EPSS 0%)
- CVE-2026-102277: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service (CVSS 5.3 · EPSS 0%)
The fix
Upgrade brace-expansion: 1.1.20 · 2.1.6 · 3.0.8 · 5.0.11 · 1.1.19 · 2.1.5 or later on your release line
Who is exposed: brace-expansion (npm) >= 4.0.0, < 5.0.10; brace-expansion (npm) >= 3.0.0, < 3.0.7; brace-expansion (npm) >= 2.0.0, < 2.1.5; brace-expansion (npm) < 1.1.19
Where it stands
- Public proof of concept
Connects to
- Same weakness: Denial of service (CWE-400). 251 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| brace-expansion | npm | >= 4.0.0, < 5.0.11 | 5.0.11 |
| brace-expansion | npm | >= 3.0.0, < 3.0.8 | 3.0.8 |
| brace-expansion | npm | >= 2.0.0, < 2.1.6 | 2.1.6 |
| brace-expansion | npm | < 1.1.20 | 1.1.20 |
References
- https://github.com/advisories/GHSA-qhr7-859c-m2p7
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
- https://nvd.nist.gov/vuln/detail/CVE-2026-102278
- https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
- https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
- https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
- https://github.com/advisories/GHSA-qhr7-859c-m2p7
Original description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.
Last activity 28 Sep 2026. Patch Forecast updates every hour.