CVE-2026-102278

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102278
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102278.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102278
Aliases
Downstream
ALSA (2)
AZL (3)
CGA (333)
CLEANSTART (9)
CLSA (22)
DEBIAN (1)
ECHO (1)
MINI (36)
openSUSE (2)
RHSA (6)
RLSA (4)
ROOT (1)
UBUNTU (1)
Related
ALSA (2)
openSUSE (2)
Published
2026-09-28T20:57:09Z
Modified
2026-10-29T22:57:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102278.json"
}
References

Affected packages

Git / github.com/juliangruber/brace-expansion

Affected ranges

Type
GIT
Repo
https://github.com/juliangruber/brace-expansion
Events
Introduced
6a39bdddcf944374b475d99b0e8292d3727c7ebe
Fixed
82479277b90f2f86263e946f9ff89689b3734568
Introduced
b01a637b0578a7c59acc7d8386f11f8d0710b512
Fixed
8bebb261fd9249c3bac705eea15d06c4ea788d5e
Introduced
0b6a022491103b806770bc037654744bef3e63be
Fixed
5a5c07b25ea84a899322ebb820336260277cbe90
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c6513ad31e08edb56dc414a629e39cba724b7548
Fixed
1efee7c397c191da6287a78ec19512476a966a7b
Fixed
935d78f32f335b2ff76578e5c5e877d31ae9888c
Fixed
de84f144e9816f30e25fc8179e2e1249ab6df0db
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "4.0.0"
                },
                {
                    "fixed": "5.0.11"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "3.0.0"
                },
                {
                    "fixed": "3.0.8"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "fixed": "2.1.6"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.1.20"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "1efee7c397c191da6287a78ec19512476a966a7b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "935d78f32f335b2ff76578e5c5e877d31ae9888c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "de84f144e9816f30e25fc8179e2e1249ab6df0db"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.1.0
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.13
v1.1.14
v1.1.15
v1.1.16
v1.1.17
v1.1.18
v1.1.19
v1.1.2
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.1.7
v1.1.8
v1.1.9
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.6
v3.0.7
v4.*
v4.0.0
v4.0.1
v5.*
v5.0.10
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102278.json"