GHSA-qhr7-859c-m2p7Published

brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

Collected exploitation and prediction evidence

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

cve-program · CVE-2026-102278

Published

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.

Source published: 28 Sep 2026 20:57:09 UTC
Source modified: 1 Oct 2026 15:02:44 UTC
Observed here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-88555

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 28, 2026, 8:57:09 PM

dateUpdated: Oct 1, 2026, 3:02:44 PM

30 related source bulletins · separate from aliases

RHSA-2026:92510: Red Hat Security Advisory: RHOAI 3.4.6 - Red Hat OpenShift AI

CVE-2023-54404 · CVE-2026-11822 · CVE-2026-11824 · CVE-2026-13717 · CVE-2026-16221 · CVE-2026-17106 · CVE-2026-18446 · CVE-2026-25681 · CVE-2026-26007 · CVE-2026-27136 · CVE-2026-33814 · CVE-2026-33818 · CVE-2026-39821 · CVE-2026-39834 · CVE-2026-41178 · CVE-2026-42502 · CVE-2026-45819 · CVE-2026-45820 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-57516 · CVE-2026-59951 · CVE-2026-63209 · CVE-2026-63374 · CVE-2026-65898 · CVE-2026-67312 · CVE-2026-67314 · CVE-2026-67320 · CVE-2026-67321 · CVE-2026-69097 · CVE-2026-69153 · CVE-2026-73086 · CVE-2026-73088 · CVE-2026-73089 · CVE-2026-73643 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-76844 · CVE-2026-77301 · CVE-2026-78679 · CVE-2026-82397 · CVE-2026-83663 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-85393 · CVE-2026-85525 · CVE-2026-87018 · CVE-2026-90711 · CVE-2026-91990 · CVE-2026-92599 · CVE-2026-93690 · CVE-2026-93749 · CVE-2026-94637 · CVE-2026-96640 · CVE-2026-96643 · CVE-2026-96644 · CVE-2026-96778 · CVE-2026-96804 · CVE-2026-97687 · CVE-2026-97689 · CVE-2026-102267 · CVE-2026-102271 · CVE-2026-102272 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-102282 · CVE-2026-104150 · CVE-2026-104851 · CVE-2026-105922 · CVE-2026-106445 · CVE-2026-106446 · CVE-2026-109156 · CVE-2026-109383 · CVE-2026-109527 · CVE-2026-109829 · CVE-2026-109869 · CVE-2026-109956 · CVE-2026-110856 · CVE-2026-110857 · CVE-2026-110858 · CVE-2026-110859 · CVE-2026-111064 · CVE-2026-111066 · CVE-2026-111497 · CVE-2026-112390 · CVE-2026-112391 · CVE-2026-112392 · CVE-2026-112397 · CVE-2026-112399 · CVE-2026-112400 · CVE-2026-112402 · CVE-2026-112404 · CVE-2026-112405 · CVE-2026-112893 · CVE-2026-112894 · CVE-2026-112895 · CVE-2026-112896 · CVE-2026-112897 · CVE-2026-112940 · CVE-2026-114145

RHSA-2026:92378: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

CVE-2026-101911 · CVE-2026-102276 · CVE-2026-102277 · CVE-2026-102278 · CVE-2026-105481 · CVE-2026-105482 · CVE-2026-105483 · CVE-2026-106069 · CVE-2026-106071 · CVE-2026-106072 · CVE-2026-106073 · CVE-2026-106074 · CVE-2026-111497

RHSA-2026:96226: Red Hat Security Advisory: nodejs:24 security update

CVE-2026-19534 · CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-109383 · CVE-2026-109869 · CVE-2026-118764 · CVE-2026-119373 · CVE-2026-119374 · CVE-2026-119379

RHSA-2026:83703: Red Hat Security Advisory: OpenShift Container Platform 4.21.39 security and extras update

CVE-2026-11332 · CVE-2026-33814 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-46597 · CVE-2026-84375 · CVE-2026-102278

RHSA-2026:95591: Red Hat Security Advisory: Cluster Observability Operator - 1.5

CVE-2026-19534 · CVE-2026-27145 · CVE-2026-33818 · CVE-2026-39821 · CVE-2026-39822 · CVE-2026-39834 · CVE-2026-42504 · CVE-2026-56853 · CVE-2026-56858 · CVE-2026-56859 · CVE-2026-56860 · CVE-2026-56862 · CVE-2026-63209 · CVE-2026-75838 · CVE-2026-75899 · CVE-2026-75931 · CVE-2026-75975 · CVE-2026-76172 · CVE-2026-77301 · CVE-2026-82417 · CVE-2026-84292 · CVE-2026-84304 · CVE-2026-84375 · CVE-2026-84445 · CVE-2026-84961 · CVE-2026-85152 · CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-109383 · CVE-2026-109829 · CVE-2026-109855 · CVE-2026-109869 · CVE-2026-116591

RHSA-2026:89342: Red Hat Security Advisory: OpenShift Container Platform 4.20.44 security and extras update

CVE-2026-33814 · CVE-2026-102278

RHSA-2026:74161: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-102276 · CVE-2026-102277 · CVE-2026-102278

RHSA-2026:94612: Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update

CVE-2026-73501 · CVE-2026-73502 · CVE-2026-77354 · CVE-2026-84445 · CVE-2026-88031 · CVE-2026-92615 · CVE-2026-102276 · CVE-2026-102278

RHSA-2026:89656: Red Hat Security Advisory: OpenShift Container Platform 4.19.53 security and extras update

CVE-2026-33814 · CVE-2026-46597 · CVE-2026-102278

RHSA-2026:73856: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-102278

RHSA-2026:92376: Red Hat Security Advisory: nodejs:24 security, bug fix, and enhancement update

RHSA-2026:94608: Red Hat Security Advisory: Red Hat Edge Manager Version 1.2.2 Security Update

CVE-2026-73501 · CVE-2026-73502 · CVE-2026-77354 · CVE-2026-84445 · CVE-2026-88031 · CVE-2026-92615 · CVE-2026-102276 · CVE-2026-102278

RHSA-2026:96234: Red Hat Security Advisory: nodejs:22 security, bug fix, and enhancement update

CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-105482 · CVE-2026-106069 · CVE-2026-109383 · CVE-2026-109869

openSUSE-SU-2026:22111-1: Security update for pi-coding-agent

CVE-2026-102276 · CVE-2026-102277 · CVE-2026-102278 · CVE-2026-84890 · CVE-2026-84933 · CVE-2026-84947 · CVE-2026-84961 · CVE-2026-85008 · CVE-2026-85014 · CVE-2026-85024 · CVE-2026-85152

RHSA-2026:95360: Red Hat Security Advisory: Red Hat build of Cryostat security update

CVE-2026-33818 · CVE-2026-39834 · CVE-2026-46603 · CVE-2026-46604 · CVE-2026-49978 · CVE-2026-56858 · CVE-2026-56862 · CVE-2026-59879 · CVE-2026-78669 · CVE-2026-82417 · CVE-2026-83663 · CVE-2026-84445 · CVE-2026-88031 · CVE-2026-90711 · CVE-2026-91135 · CVE-2026-94637 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-106445 · CVE-2026-106446

RHSA-2026:73914: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-102278

openSUSE-SU-2026:11967-1: pi-coding-agent-1.0.0-1.1 on GA media

CVE-2026-102277 · CVE-2026-102278

RHSA-2026:92136: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

CVE-2026-33245 · CVE-2026-93749 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-102422 · CVE-2026-104861 · CVE-2026-111064 · CVE-2026-111066

RHSA-2026:96094: Red Hat Security Advisory: nodejs22 security update

CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-105482 · CVE-2026-106069 · CVE-2026-109383 · CVE-2026-109829 · CVE-2026-109869

RHSA-2026:92578: Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

CVE-2026-9496 · CVE-2026-90711 · CVE-2026-97057 · CVE-2026-102276 · CVE-2026-102278

RHSA-2026:74167: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-102276 · CVE-2026-102277 · CVE-2026-102278

RHSA-2026:95081: Red Hat Security Advisory: Cluster Observability Operator - 1.5

RHSA-2026:92584: Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

CVE-2026-9496 · CVE-2026-90711 · CVE-2026-97057 · CVE-2026-102276 · CVE-2026-102278

RHSA-2026:96236: Red Hat Security Advisory: nodejs-nodemon security update

CVE-2026-102276 · CVE-2026-102278

RHSA-2026:96088: Red Hat Security Advisory: nodejs24 security, bug fix, and enhancement update

CVE-2026-87018 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-105482 · CVE-2026-105483 · CVE-2026-106069 · CVE-2026-109383 · CVE-2026-109829 · CVE-2026-109869

RHSA-2026:73916: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-102278

RHSA-2026:89199: Red Hat Security Advisory: OpenShift Container Platform 4.22.20 security and extras update

CVE-2026-33814 · CVE-2026-85781 · CVE-2026-102278

msrc_CVE-2026-102278: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion

CVE-2026-102278

RHSA-2026:74168: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

CVE-2026-102276 · CVE-2026-102277 · CVE-2026-102278

RHSA-2026:91967: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

CVE-2026-33245 · CVE-2026-93749 · CVE-2026-102276 · CVE-2026-102278 · CVE-2026-102422 · CVE-2026-104861 · CVE-2026-111064 · CVE-2026-111066

Source published: Sep 28, 2026, 8:57:09 PM (timezone not stated)
Source modified: Oct 1, 2026, 3:02:44 PM (timezone not stated)
Observed here: 11 Nov 2026 05:29:02 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-102278

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-400 · CWE-674

Original publisher date fields

published: 2026-09-28T21:17:16.517

lastModified: 2026-10-01T15:17:25.593

Source published: 28 Sep 2026 21:17:16 UTC
Source modified: 1 Oct 2026 15:17:25 UTC
Observed here: 25 Oct 2026 04:17:26 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-qhr7-859c-m2p7

Published

### Summary `expand_()` recurses once per level of brace *nesting*. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the *tail* iterative (recursion on `m.post`, driven by how many groups are chained). Nesting depth drives a different recursion that the tail fix never touched, so the documented constant-stack-depth guarantee only ever covered chained input, not nested input. It is also distinct from GHSA-6j4f-fj2g-mc7p, which fixed recursion in `parseCommaParts()`. Both payloads below still crash with that fix applied. ### Two recursion sites **Comma members.** Each alternative of a brace set is expanded by a recursive call, so nesting a set inside every alternative recurses once per level: ```js expand('{a,'.repeat(4000) + 'z' + '}'.repeat(4000)) // RangeError: Maximum call stack size exceeded ``` Crashes at depth 3,907 - about **15.6 KB** of input. **Single set.** A brace set whose body parses to a single part is expanded by a recursive call before being re-wrapped (`x{{a,b}}y` -> `x{a}y x{b}y`), which recurses once per nesting level: ```js expand('{'.repeat(3200) + 'a,b' + '}'.repeat(3200)) // RangeError: Maximum call stack size exceeded ``` Crashes at depth 3,125 - about **6.25 KB** of input. This is the cheapest stack-exhaustion payload known against this package: roughly a quarter the input of GHSA-6j4f-fj2g-mc7p (29 KB), and about a tenth of minimatch's `MAX_PATTERN_LENGTH` (65,536). ### Why `max` and `maxLength` do not help Both crashes happen while recursing into sub-expansions, before the result set grows. The payloads produce almost no output - the single-set case yields 2 results - so neither bound is ever the limiter. `expand(payload, { max: 1, maxLength: 1 })` still overflows. ### Impact Any application passing an untrusted string to `expand()`, directly or through `minimatch` / `glob` as a user-supplied glob pattern, can be crashed. In Node a `RangeError` the application does not catch terminates the process, so a server globbing user input is exposed to remote unauthenticated denial of service. Availability only. No code execution, no data exposure. ### Affected versions Verified affected on 1.1.18, 2.1.4, 3.0.6 and 5.0.9, at near-identical depths on every line (single set: 3,125 on all four; comma members: 3,907-4,102). Not a regression from any recent fix - the gap predates them. ### Patch A `maxDepth` bound (default `EXPANSION_MAX_DEPTH`) is threaded through `expand_()`. Past the cap a group is treated as non-expanding and returned literally, which is how the parser already handles a group that cannot expand. This matches the existing `max` / `maxLength` caps, which truncate rather than throw, so `expand()` continues never to throw on any input. The default sits far above any realistic nesting depth and well below the crash threshold.

Source published: 29 Sep 2026 23:45:17 UTC
Source modified: 30 Sep 2026 00:00:04 UTC
Observed here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH