UBUNTU-CVE-2026-102276

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-102276
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-102276
Upstream
Published
2026-09-29T00:00:00Z
Modified
2026-09-29T23:41:45Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.

References

Affected packages

Ubuntu:18.04:LTS / node-brace-expansion

Package

Name
node-brace-expansion
Purl
pkg:deb/ubuntu/node-brace-expansion?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.8-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-brace-expansion",
            "binary_version":  "1.1.8-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json"

Ubuntu:20.04:LTS / node-brace-expansion

Package

Name
node-brace-expansion
Purl
pkg:deb/ubuntu/node-brace-expansion?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.1.8-1
1.1.11-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-brace-expansion",
            "binary_version":  "1.1.11-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json"

Ubuntu:22.04:LTS / node-brace-expansion

Package

Name
node-brace-expansion
Purl
pkg:deb/ubuntu/node-brace-expansion?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.0-1
2.0.1-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-brace-expansion",
            "binary_version":  "2.0.1-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json"

Ubuntu:24.04:LTS / node-brace-expansion

Package

Name
node-brace-expansion
Purl
pkg:deb/ubuntu/node-brace-expansion?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.1-2
2.0.1+~1.1.0-1

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-brace-expansion",
            "binary_version":  "2.0.1+~1.1.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json"

Ubuntu:26.04:LTS / node-brace-expansion

Package

Name
node-brace-expansion
Purl
pkg:deb/ubuntu/node-brace-expansion?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.0.1+~1.1.0-2

Ecosystem specific 

{
    "binaries":  [
        {
            "binary_name":  "node-brace-expansion",
            "binary_version":  "2.0.1+~1.1.0-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-102276.json"