Denial of Service Vulnerability in Brace Expansion Library by Julian Gruber
CVE-2026-102278
7.5HIGH
What is CVE-2026-102278?
The brace-expansion library, utilized for generating arbitrary strings with specific prefixes and suffixes, has a vulnerability that allows for uncontrolled recursion. If the library processes deeply nested brace groups from untrusted patterns, it can exhaust the native stack during the expansion process, leading to potential termination of the Node.js application. This vulnerability impacts versions prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11. Developers should ensure they upgrade to fixed versions to mitigate this process-terminating denial of service risk.
Affected Version(s)
brace-expansion >= 4.0.0, < 5.0.11 < 4.0.0, 5.0.11
brace-expansion >= 3.0.0, < 3.0.8 < 3.0.0, 3.0.8
brace-expansion >= 2.0.0, < 2.1.6 < 2.0.0, 2.1.6