brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Published Sep 28, 2026
7.5
HIGHCVSS 3.1
EPSS 0.35%
Description
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.
Affected products
-
- Version < 1.1.20StatusaffectedConstraints-
- Version >= 2.0.0, < 2.1.6StatusaffectedConstraints-
- Version >= 3.0.0, < 3.0.8StatusaffectedConstraints-
- Version >= 4.0.0, < 5.0.11StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Juliangruber | Brace-Expansion | n/a |
|
No data.
No data.
Red Hat Hardened Images
nodejs22-main-10.9.9-1.22.23.3.2.3.2.1.hum1
Fixed · RHSA-2026:73914
Red Hat Hardened Images
nodejs24-main-11.19.0-1.24.21.0.1.1.hum1
Fixed · RHSA-2026:73916
Red Hat Hardened Images
nodejs26-main-11.19.1-1.26.10.0.0.2.hum1
Fixed · RHSA-2026:73856
Red Hat Hardened Images
dotnet8.0
Not affected
Red Hat Hardened Images
grafana12.4
Affected
Red Hat Hardened Images
grafana13.1
Affected
Red Hat Hardened Images
grafana13.2
Affected
Red Hat Hardened Images
jaeger
Not affected
Red Hat Hardened Images
llvm21
Not affected
Red Hat Hardened Images
nodejs20
Will not fix
Red Hat Hardened Images
nodejs25
Will not fix
Red Hat Hardened Images
opentelemetry-collector
Not affected
Red Hat Hardened Images
opentelemetry-collector-contrib
Not affected
Red Hat Hardened Images
opentelemetry-collector-k8s
Not affected
Red Hat Hardened Images
prometheus3.13
Not affected
Red Hat Hardened Images
rust
Not affected
Red Hat Hardened Images
swift-lang
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | nodejs22-main-10.9.9-1.22.23.3.2.3.2.1.hum1 | Fixed | RHSA-2026:73914 |
| Red Hat Hardened Images | nodejs24-main-11.19.0-1.24.21.0.1.1.hum1 | Fixed | RHSA-2026:73916 |
| Red Hat Hardened Images | nodejs26-main-11.19.1-1.26.10.0.0.2.hum1 | Fixed | RHSA-2026:73856 |
| Red Hat Hardened Images | dotnet8.0 | Not affected | n/a |
| Red Hat Hardened Images | grafana12.4 | Affected | n/a |
| Red Hat Hardened Images | grafana13.1 | Affected | n/a |
| Red Hat Hardened Images | grafana13.2 | Affected | n/a |
| Red Hat Hardened Images | jaeger | Not affected | n/a |
| Red Hat Hardened Images | llvm21 | Not affected | n/a |
| Red Hat Hardened Images | nodejs20 | Will not fix | n/a |
| Red Hat Hardened Images | nodejs25 | Will not fix | n/a |
| Red Hat Hardened Images | opentelemetry-collector | Not affected | n/a |
| Red Hat Hardened Images | opentelemetry-collector-contrib | Not affected | n/a |
| Red Hat Hardened Images | opentelemetry-collector-k8s | Not affected | n/a |
| Red Hat Hardened Images | prometheus3.13 | Not affected | n/a |
| Red Hat Hardened Images | rust | Not affected | n/a |
| Red Hat Hardened Images | swift-lang | Not affected | n/a |
brace-expansion
npm
Introduced 4.0.0 Fixed 5.0.11brace-expansion
npm
Introduced 3.0.0 Fixed 3.0.8brace-expansion
npm
Introduced 2.0.0 Fixed 2.1.6brace-expansion
npm
Introduced 0 Fixed 1.1.20
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | brace-expansion | 4.0.0 | 5.0.11 |
| npm | brace-expansion | 3.0.0 | 3.0.8 |
| npm | brace-expansion | 2.0.0 | 2.1.6 |
| npm | brace-expansion | 0 | 1.1.20 |
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
YesTechnical Impact
PartialDecision
n/aAssessed Oct 1, 2026 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
Not enough EPSS history yet for a chart. At least two recorded scores are needed.
Percentile over time
Not enough EPSS history yet for a chart. At least two recorded scores are needed.
References (9)
- https://access.redhat.com/security/cve/CVE-2026-102278 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2542700 Issue Tracking
- https://github.com/advisories/GHSA-qhr7-859c-m2p7 Advisory
- https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db x_refsource_MISC
- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7 x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-102278
- https://www.cve.org/CVERecord?id=CVE-2026-102278
Change history (0)
No recorded changes yet.