CVE-2026-102278

Received Received - Intake

Stack Exhaustion in Brace Expansion Library

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-102278

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves the brace-expansion library in Node.js, which generates strings from patterns. Due to uncontrolled recursion in deeply nested brace groups, the library exhausts the native stack before output limits can apply, potentially crashing the Node.js process. This leads to a denial of service.

Detection Guidance

This vulnerability involves stack exhaustion from deeply nested brace expansions in the brace-expansion library. Detection requires checking the installed version of the library in your Node.js environment. Use commands like 'npm list brace-expansion' or 'npm ls brace-expansion' to identify the version. If the version is below 1.1.20, 2.1.6, 3.0.8, or 5.0.11, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability can cause a denial of service by crashing the Node.js process. This disrupts applications relying on the brace-expansion library, leading to downtime or service unavailability.

Compliance Impact

This vulnerability causes a denial of service by exhausting the native stack through deeply nested brace expansions, which could lead to process termination. While not directly related to data protection, such disruptions may impact system availability required by GDPR and HIPAA.

Mitigation Strategies

Immediately update the brace-expansion library to a patched version: 1.1.20, 2.1.6, 3.0.8, or 5.0.11 or later. Use 'npm update brace-expansion' or manually specify the version in your package.json. Remove or restrict untrusted input patterns that use deeply nested brace expansions to prevent stack exhaustion.

Hi! I’m here to help you understand CVE-2026-102278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70