CVE-2026-102276 in brace-expansion
Summary
by MITRE • 09/29/2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The brace-expansion library for Node.js contains a critical vulnerability that allows attackers to trigger a process-terminating denial of service through crafted input patterns. This flaw stems from the way the parseCommaParts function handles recursive processing and array argument passing when expanding brace expressions. Specifically, prior to versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10, the implementation fails to adequately limit recursion depth or array size before attempting to process them via native JavaScript mechanisms that have strict limits on stack usage and argument count.
The technical root cause involves two distinct but related failure modes within the parseCommaParts function. First, when processing brace patterns with many comma-separated groups, the function enters a recursive path where it processes the remainder of the string for each group. Without sufficient safeguards against deep recursion, this leads to native stack exhaustion as the call stack grows beyond the limits imposed by the JavaScript engine. Second, even in cases that do not trigger deep recursion, the use of push.apply to pass every element of a very large comma-part array as individual function arguments triggers a separate limit violation. Most JavaScript engines enforce a maximum number of arguments for any single function invocation, and exceeding this threshold results in an immediate crash or unhandled exception that terminates the Node.js process.
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption because it allows an attacker to exhaust system resources (specifically memory stack space) through specially crafted input rather than legitimate usage patterns. From a threat modeling perspective, this aligns with ATT&CK technique T1496: Resource Hijacking, where the primary objective is not data theft or code execution but rather disrupting service availability by consuming computational resources until failure occurs. The impact is severe for any application that relies on brace-expansion functionality to process user-supplied strings without prior validation or sanitization of input complexity and size.
Mitigation strategies require immediate upgrading to patched versions 1.1.19, 2.1.5, 3.0.7, or 5.0.10 depending on the specific branch in use. For applications unable to upgrade immediately, defensive coding practices should be implemented including strict input validation that limits string length and complexity before passing data to brace-expansion functions. Additionally, wrapping calls in try-catch blocks can prevent unhandled exceptions from crashing the entire process, although this is a secondary defense rather than a primary fix since stack exhaustion may still cause crashes regardless of exception handling depending on engine behavior.