--- id: CVE-2026-102278 title: >- The brace-expansion library generates arbitrary strings containing a common prefix and suffix summary: >- The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and si… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-400 - CWE-674 - CWE-770 vendor: juliangruber product: brace-expansion affected: - 'brace-expansion >= 4.0.0, < 5.0.11' - 'brace-expansion >= 3.0.0, < 3.0.8' - 'brace-expansion >= 2.0.0, < 2.1.6' - brace-expansion < 1.1.20 patched: - brace-expansion 5.0.11 - brace-expansion 3.0.8 - brace-expansion 2.1.6 - brace-expansion 1.1.20 published: '2026-09-28' updated: '2026-10-01' sourceUpdated: '2026-10-01T15:17:25.593' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102278' references: - url: >- https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b label: security-advisories@github.com - url: >- https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c label: security-advisories@github.com - url: >- https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db label: security-advisories@github.com - url: >- https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7 label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102278.json - url: 'https://access.redhat.com/security/cve/CVE-2026-102278' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2542700' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-102278' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102278' - url: 'https://github.com/advisories/GHSA-qhr7-859c-m2p7' - url: 'https://access.redhat.com/errata/RHSA-2026:73914' - url: 'https://access.redhat.com/errata/RHSA-2026:74161' - url: 'https://access.redhat.com/errata/RHSA-2026:73916' - url: 'https://access.redhat.com/errata/RHSA-2026:74167' - url: 'https://access.redhat.com/errata/RHSA-2026:73856' - url: 'https://access.redhat.com/errata/RHSA-2026:74168' - url: 'https://access.redhat.com/errata/RHSA-2026:83703' tags: - nvd - cve.org - csaf - vex - red-hat - ghsa - npm ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-10-01T15:02:35.975978Z' epss: 0.00455 epssPercentile: 0.39329 aliases: - GHSA-qhr7-859c-m2p7 ecosystem: npm ingestedAt: '2026-09-28T21:20:54.784Z' scores: nvd: 7.5 vendor: 6.5 --- ## Overview The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-102278) Affected packages: - `brace-expansion >= 4.0.0, < 5.0.11` - `brace-expansion >= 3.0.0, < 3.0.8` - `brace-expansion >= 2.0.0, < 2.1.6` - `brace-expansion < 1.1.20` Patched in: - `brace-expansion 5.0.11` - `brace-expansion 3.0.8` - `brace-expansion 2.1.6` - `brace-expansion 1.1.20` Source: https://github.com/advisories/GHSA-qhr7-859c-m2p7 ## Vendor advisories - **Red Hat VEX** · Important · affected: Cost Management On Premise, Cryostat 4, Exploit Intelligence, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Node HealthCheck Operator, … · no fix planned: Red Hat Ansible Automation Platform 2, Red Hat Fuse 7, Red Hat Hardened Images, Red Hat JBoss Enterprise Application Platform 7, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-102278.json) - **RHSA-2026:73914** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73914) - **RHSA-2026:74161** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74161) - **RHSA-2026:73916** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73916) - **RHSA-2026:74167** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74167) - **RHSA-2026:73856** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:73856) - **RHSA-2026:74168** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:74168) - **RHSA-2026:83703** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:83703)