CVE-2026-102278 in brace-expansion
Summary
by MITRE • 09/29/2026
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The brace expansion library for Node.js contains a critical vulnerability related to uncontrolled recursion that can lead to process termination via stack exhaustion. This flaw affects multiple versions of the library, specifically those prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11. The core issue resides within the internal expand_ function, which is responsible for processing brace patterns such as comma-separated members and single-set expansions. When an attacker supplies a deeply nested pattern containing multiple levels of braces, the library attempts to recursively process each level of nesting without adequate safeguards against excessive depth. This behavior triggers uncontrolled recursion where the call stack grows proportionally with the number of nested groups rather than being bounded by output limits or iteration counts.
From a technical perspective, this vulnerability is classified under CWE-675, which denotes operations on data with unintentional repetition, and aligns with ATT&CK technique T1499, Endpoint Denial of Service. The recursive nature of the expand_ function means that for every level of nesting in the input string, a new stack frame is allocated. In JavaScript environments like Node.js, the call stack has a finite size determined by the engine's implementation and available memory. When the depth of nested braces exceeds this limit, the native stack becomes exhausted. This results in a runtime error that typically crashes the entire Node.js process rather than just failing gracefully within the library itself. The vulnerability is particularly dangerous because it can be triggered remotely if the input originates from user-supplied data or external sources without proper sanitization.
The operational impact of this flaw is severe, leading to a denial of service condition for any application relying on the affected versions of the brace expansion library. Since Node.js applications often run as long-lived processes handling multiple requests, crashing one instance can disrupt services and require manual intervention or automatic restarts by orchestration tools. This not only affects availability but also increases resource consumption during recovery phases. The lack of output limits being applied before stack exhaustion means that even small inputs with high nesting depth are sufficient to trigger the crash, making it easy for an attacker to exploit this weakness without needing large payloads.
To mitigate this vulnerability, organizations must upgrade the brace-expansion library to version 1.1.20 or later, depending on their specific major version line. For users of older branches, upgrading to 2.1.6, 3.0.8, or 5.0.11 respectively is required. If immediate patching is not feasible, implementing input validation at the application layer can serve as a temporary workaround by limiting the depth of nested braces in user-supplied patterns before they are passed to the library. Additionally, deploying runtime protection mechanisms such as process managers that automatically restart crashed instances can help maintain availability while patches are applied. Regularly auditing dependencies for known vulnerabilities and keeping them updated is essential to prevent similar issues arising from uncontrolled recursion or stack exhaustion flaws in other libraries.