{"id":"EUVD-2026-88555","revision":null,"records":[{"revision":"2a79a53c533640c4baf1d22a08b26f67","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102278","aliases":[],"title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","state":0,"publishedAt":"2026-09-28T20:57:09.85+00:00","modifiedAt":"2026-10-01T15:02:44.798+00:00","affected":[{"ecosystem":"Vendor product","name":"brace-expansion","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"juliangruber\",\n                    \"product\": \"brace-expansion\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 5.0.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, < 3.0.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, < 2.1.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 1.1.20\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102278","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102278","identifiers":["CVE-2026-102278"]},"retained":false,"historicalAffected":[]},{"revision":"c526f184d2fa4a138a27b8efc4abf748","observedAt":"2026-11-11T05:29:02.582+00:00","statement":{"source":"euvd","id":"EUVD-2026-88555","aliases":["CVE-2026-102278","GHSA-qhr7-859c-m2p7"],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and singl…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88555","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 28, 2026, 8:57:09 PM","dateUpdated":"Oct 1, 2026, 3:02:44 PM"},"relatedAdvisories":[{"id":"RHSA-2026:92510","title":"Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2023-54404","CVE-2026-11822","CVE-2026-11824","CVE-2026-13717","CVE-2026-16221","CVE-2026-17106","CVE-2026-18446","CVE-2026-25681","CVE-2026-26007","CVE-2026-27136","CVE-2026-33814","CVE-2026-33818","CVE-2026-39821","CVE-2026-39834","CVE-2026-41178","CVE-2026-42502","CVE-2026-45819","CVE-2026-45820","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-57516","CVE-2026-59951","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-67312","CVE-2026-67314","CVE-2026-67320","CVE-2026-67321","CVE-2026-69097","CVE-2026-69153","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73643","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-76844","CVE-2026-77301","CVE-2026-78679","CVE-2026-82397","CVE-2026-83663","CVE-2026-84375","CVE-2026-84445","CVE-2026-85393","CVE-2026-85525","CVE-2026-87018","CVE-2026-90711","CVE-2026-91990","CVE-2026-92599","CVE-2026-93690","CVE-2026-93749","CVE-2026-94637","CVE-2026-96640","CVE-2026-96643","CVE-2026-96644","CVE-2026-96778","CVE-2026-96804","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102271","CVE-2026-102272","CVE-2026-102276","CVE-2026-102278","CVE-2026-102282","CVE-2026-104150","CVE-2026-104851","CVE-2026-105922","CVE-2026-106445","CVE-2026-106446","CVE-2026-109156","CVE-2026-109383","CVE-2026-109527","CVE-2026-109829","CVE-2026-109869","CVE-2026-109956","CVE-2026-110856","CVE-2026-110857","CVE-2026-110858","CVE-2026-110859","CVE-2026-111064","CVE-2026-111066","CVE-2026-111497","CVE-2026-112390","CVE-2026-112391","CVE-2026-112392","CVE-2026-112397","CVE-2026-112399","CVE-2026-112400","CVE-2026-112402","CVE-2026-112404","CVE-2026-112405","CVE-2026-112893","CVE-2026-112894","CVE-2026-112895","CVE-2026-112896","CVE-2026-112897","CVE-2026-112940","CVE-2026-114145"]},{"id":"RHSA-2026:92378","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-101911","CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106071","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"]},{"id":"RHSA-2026:96226","title":"Red Hat Security Advisory: nodejs:24 security update","vulnerabilityIds":["CVE-2026-19534","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109869","CVE-2026-118764","CVE-2026-119373","CVE-2026-119374","CVE-2026-119379"]},{"id":"RHSA-2026:83703","title":"Red Hat Security Advisory: OpenShift Container Platform 4.21.39 security and extras update","vulnerabilityIds":["CVE-2026-11332","CVE-2026-33814","CVE-2026-44431","CVE-2026-44432","CVE-2026-46597","CVE-2026-84375","CVE-2026-102278"]},{"id":"RHSA-2026:95591","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869","CVE-2026-116591"]},{"id":"RHSA-2026:89342","title":"Red Hat Security Advisory: OpenShift Container Platform 4.20.44 security and extras update","vulnerabilityIds":["CVE-2026-33814","CVE-2026-102278"]},{"id":"RHSA-2026:74161","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:94612","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update","vulnerabilityIds":["CVE-2026-73501","CVE-2026-73502","CVE-2026-77354","CVE-2026-84445","CVE-2026-88031","CVE-2026-92615","CVE-2026-102276","CVE-2026-102278"]},{"id":"RHSA-2026:89656","title":"Red Hat Security Advisory: OpenShift Container Platform 4.19.53 security and extras update","vulnerabilityIds":["CVE-2026-33814","CVE-2026-46597","CVE-2026-102278"]},{"id":"RHSA-2026:73856","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-102278"]},{"id":"RHSA-2026:92376","title":"Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-101911","CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-105481","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-106071","CVE-2026-106072","CVE-2026-106073","CVE-2026-106074","CVE-2026-111497"]},{"id":"RHSA-2026:94608","title":"Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update","vulnerabilityIds":["CVE-2026-73501","CVE-2026-73502","CVE-2026-77354","CVE-2026-84445","CVE-2026-88031","CVE-2026-92615","CVE-2026-102276","CVE-2026-102278"]},{"id":"RHSA-2026:96234","title":"Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-105482","CVE-2026-106069","CVE-2026-109383","CVE-2026-109869"]},{"id":"openSUSE-SU-2026:22111-1","title":"Security update for pi-coding-agent","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278","CVE-2026-84890","CVE-2026-84933","CVE-2026-84947","CVE-2026-84961","CVE-2026-85008","CVE-2026-85014","CVE-2026-85024","CVE-2026-85152"]},{"id":"RHSA-2026:95360","title":"Red Hat Security Advisory: Red Hat build of Cryostat security update","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39834","CVE-2026-46603","CVE-2026-46604","CVE-2026-49978","CVE-2026-56858","CVE-2026-56862","CVE-2026-59879","CVE-2026-78669","CVE-2026-82417","CVE-2026-83663","CVE-2026-84445","CVE-2026-88031","CVE-2026-90711","CVE-2026-91135","CVE-2026-94637","CVE-2026-102276","CVE-2026-102278","CVE-2026-106445","CVE-2026-106446"]},{"id":"RHSA-2026:73914","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-102278"]},{"id":"openSUSE-SU-2026:11967-1","title":"pi-coding-agent-1.0.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:92136","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2026-33245","CVE-2026-93749","CVE-2026-102276","CVE-2026-102278","CVE-2026-102422","CVE-2026-104861","CVE-2026-111064","CVE-2026-111066"]},{"id":"RHSA-2026:96094","title":"Red Hat Security Advisory: nodejs22 security update","vulnerabilityIds":["CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-105482","CVE-2026-106069","CVE-2026-109383","CVE-2026-109829","CVE-2026-109869"]},{"id":"RHSA-2026:92578","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-9496","CVE-2026-90711","CVE-2026-97057","CVE-2026-102276","CVE-2026-102278"]},{"id":"RHSA-2026:74167","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:95081","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869"]},{"id":"RHSA-2026:92584","title":"Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image","vulnerabilityIds":["CVE-2026-9496","CVE-2026-90711","CVE-2026-97057","CVE-2026-102276","CVE-2026-102278"]},{"id":"RHSA-2026:96236","title":"Red Hat Security Advisory: nodejs-nodemon security update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102278"]},{"id":"RHSA-2026:96088","title":"Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update","vulnerabilityIds":["CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-105482","CVE-2026-105483","CVE-2026-106069","CVE-2026-109383","CVE-2026-109829","CVE-2026-109869"]},{"id":"RHSA-2026:73916","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-102278"]},{"id":"RHSA-2026:89199","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.20 security and extras update","vulnerabilityIds":["CVE-2026-33814","CVE-2026-85781","CVE-2026-102278"]},{"id":"msrc_CVE-2026-102278","title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","vulnerabilityIds":["CVE-2026-102278"]},{"id":"RHSA-2026:74168","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-102276","CVE-2026-102277","CVE-2026-102278"]},{"id":"RHSA-2026:91967","title":"Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage","vulnerabilityIds":["CVE-2026-33245","CVE-2026-93749","CVE-2026-102276","CVE-2026-102278","CVE-2026-102422","CVE-2026-104861","CVE-2026-111064","CVE-2026-111066"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-88555","identifiers":["EUVD-2026-88555","CVE-2026-102278","GHSA-qhr7-859c-m2p7"]},"retained":false,"historicalAffected":[]},{"revision":"f6063c74c17c4e6891f12aa91b6a2dfb","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-102278","aliases":[],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and singl…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","state":0,"publishedAt":"2026-09-28T21:17:16.517+00:00","modifiedAt":"2026-10-01T15:17:25.593+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-400","CWE-674"],"productCriteria":[],"sourceDates":{"published":"2026-09-28T21:17:16.517","lastModified":"2026-10-01T15:17:25.593"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-102278","identifiers":["CVE-2026-102278"]},"retained":false,"historicalAffected":[]},{"revision":"757aad3eba96498eb034909e04bfc807","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-qhr7-859c-m2p7","aliases":["CVE-2026-102278"],"title":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","description":"### Summary\n\n`expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process.\n\nThis is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input.\n\nIt is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in `parseCommaParts()`. Both payloads below still crash with that fix applied.\n\n### Two recursion sites\n\n**Comma members.** Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level:\n\n```js\nexpand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,907 - about **15.6 KB** of input.\n\n**Single set.** A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (`x{{a,b}}y` -> `x{a}y x{b}y`), which recurses once per nesting level:\n\n```js\nexpand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200))\n// RangeError: Maximum call stack size exceeded\n```\n\nCrashes at depth 3,125 - about **6.25 KB** of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's `MAX_PATTERN_LENGTH` (65,536).\n\n### Why `max` and `maxLength` do not help\n\nBoth crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows.\n\n### Impact\n\nAny application passing an untrusted string to `expand()`, directly or through `minimatch` / `glob` as a user-supplied glob pattern, can be crashed. In Node a `RangeError` the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service.\n\nAvailability only. No code execution, no data exposure.\n\n### Affected versions\n\nVerified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them.\n\n### Patch\n\nA `maxDepth` bound (default `EXPANSION_MAX_DEPTH`) is threaded through `expand_()`. Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing `max` / `maxLength` caps, which truncate rather than throw, so `expand()` continues never to throw on any input.\n\nThe default sits far above any realistic nesting depth and well below the crash threshold.","state":0,"publishedAt":"2026-09-29T23:45:17+00:00","modifiedAt":"2026-09-30T00:00:04.4027633+00:00","affected":[{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"5.0.11"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.1.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.20"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion"],"sourceUrl":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qhr7-859c-m2p7","identifiers":["GHSA-qhr7-859c-m2p7","CVE-2026-102278"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T14:19:14.3117370+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T14:19:14.311737+00:00","lastSuccessAt":"2026-11-12T14:19:14.4818966+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:14.4818983+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-1f475932803f43731efb601a353520022b80ee578b55aa5e5679b2f4a36c9787","complete":true,"records":424674,"lastAttemptAt":"2026-11-12T14:16:39.2778119+00:00","lastSuccessAt":"2026-11-12T14:16:39.1789314+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:16:39.2778119+00:00","snapshotPublishedAt":"2026-11-12T13:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b71b033aac084d03b26d22d9fc7946be","complete":true,"records":13768,"lastAttemptAt":"2026-11-12T14:19:45.9206451+00:00","lastSuccessAt":"2026-11-12T14:19:45.916+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:45.916+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13821,"expectedIdentifiers":13821,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T14:19:14.3117370+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T14:19:14.311737+00:00","lastSuccessAt":"2026-11-12T14:19:14.4834548+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:14.4834554+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e770b2c8953a418da4155acf165354b0","complete":false,"records":13768,"lastAttemptAt":"2026-11-12T14:19:40.006186+00:00","lastSuccessAt":"2026-11-12T14:19:40+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:40+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13821,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T14:19:09.3390664+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:09.3390664+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T14:16:39.4225565+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:16:39.4225565+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-2ddca03541b6d702cd647c4ccdf86e2571d72c6651fcbefe015fdd203be6a10b","complete":true,"records":3112,"lastAttemptAt":"2026-11-12T14:19:14.2642415+00:00","lastSuccessAt":"2026-11-12T14:19:14.0595136+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:14.2642415+00:00","snapshotPublishedAt":"2026-11-12T14:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f83f4d2ac805fc9cd09814d7713c87f6739213e1c292111fd720d373b13b51c4","complete":true,"records":231701,"lastAttemptAt":"2026-11-12T14:19:09.2044874+00:00","lastSuccessAt":"2026-11-12T14:19:07.6352312+00:00","error":null,"lastVerifiedAt":"2026-11-12T14:19:09.2044874+00:00","snapshotPublishedAt":"2026-11-12T13:33:24+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}