CVE-2026-102276

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102276
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102276.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102276
Aliases
Downstream
CGA (298)
DEBIAN (1)
MINI (17)
UBUNTU (1)
Published
2026-09-28T20:50:59Z
Modified
2026-09-30T03:47:05Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400",
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102276.json"
}
References

Affected packages

Git / github.com/juliangruber/brace-expansion

Affected ranges

Type
GIT
Repo
https://github.com/juliangruber/brace-expansion
Events
Introduced
6a39bdddcf944374b475d99b0e8292d3727c7ebe
Introduced
b01a637b0578a7c59acc7d8386f11f8d0710b512
Introduced
0b6a022491103b806770bc037654744bef3e63be
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df7682f386cdf2d7fef6067bc78ed70d824e1f3f
Fixed
521e32927a71595d5fdc032b1e12ac2accfb1d3e
Fixed
aae3387e0d4c551480c963f1241abd3a80a279e6
Fixed
a34340a053abb475cc226aeb3f71887018e71bd0
Fixed
0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
Fixed
316359e6019c39b3254c8ba8e25dc586a480652c
Fixed
5171e681c0922b7ae8bfaf9a331e309107be6edc
Fixed
6735c94873ca570bcdd6a0690033bdd3126379d3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "5.0.10"
        },
        {
            "introduced":  "3.0.0"
        },
        {
            "fixed":  "3.0.7"
        },
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "2.1.5"
        },
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.1.19"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.6
v4.*
v4.0.0
v4.0.1
v5.*
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102276.json"