brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

🗓️ 29 Sep 2026 23:45:17Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 6 Views

DoS in brace-expansion via stack exhaustion from deeply nested brace groups.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-102278	30 Sep 202609:30	–	circl
CVE	CVE-2026-102278	28 Sep 202620:57	–	cve
Cvelist	CVE-2026-102278 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion	28 Sep 202620:57	–	cvelist
Debian CVE	CVE-2026-102278	28 Sep 202620:57	–	debiancve
EUVD	EUVD-2026-88555	28 Sep 202620:57	–	euvd
NVD	CVE-2026-102278	28 Sep 202621:17	–	nvd
OSV	DEBIAN-CVE-2026-102278	28 Sep 202621:17	–	osv
OSV	GHSA-QHR7-859C-M2P7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion	29 Sep 202623:45	–	osv
OSV	UBUNTU-CVE-2026-102278	29 Sep 202600:00	–	osv
Patchstack	NPM: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion	29 Sep 202623:45	–	patchstack

Vulners

Node

OR

juliangruber brace-expansionRange<1.1.20npm

juliangruber brace-expansionRange2.0.0–2.1.6npm

juliangruber brace-expansionRange3.0.0–3.0.8npm

juliangruber brace-expansionRange4.0.0–5.0.11npm

Source	Link
github	www.github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-102278
github	www.github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b
github	www.github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c
github	www.github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db
github	www.github.com/advisories/GHSA-qhr7-859c-m2p7

29 Sep 2026 23:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.0035

CWE-400 CWE-674

brace-expansion DoS stack exhaustion nested brace groups expand()untrusted string