CVE-2026-102278: brace-expansion Denial of Service via Uncontrolled Recursion
Summary
CVE-2026-102278: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion. Affects brace-expansion across 4 version ranges.
< 1.1.20
>= 2.0.0, < 2.1.6
>= 3.0.0, < 3.0.8
>= 4.0.0, < 5.0.11
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Brace-expansion is a widely used npm package that allows users to generate strings based on a specified pattern using braces. This package is commonly utilized in various applications for tasks such as globbing and pattern matching. However, it is vulnerable to a Denial of Service (DoS) attack due to uncontrolled recursion on nested brace groups, which can lead to stack exhaustion and application crashes.
Vulnerability Detail
The vulnerability arises from the expand_() function in the brace-expansion package, which recurses for each level of brace nesting. If an attacker provides deeply nested input, it can exhaust the native stack, causing the application to crash. This issue is distinct from other vulnerabilities as it specifically targets the recursion depth driven by nested braces rather than chained inputs. The vulnerability can be exploited by passing untrusted strings to the expand() function, leading to a potential Denial of Service (DoS) scenario where the application terminates unexpectedly.
How To Fix
Latest published version: 5.0.12 as of 22 Oct 2026
npm install brace-expansion@5.0.12Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.1.201.1.20npm install brace-expansion@1.1.20 -
>= 2.0.0, < 2.1.62.1.6npm install brace-expansion@2.1.6 -
>= 3.0.0, < 3.0.83.0.8npm install brace-expansion@3.0.8 -
>= 4.0.0, < 5.0.115.0.11npm install brace-expansion@5.0.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted or deeply nested strings to the expand() function. Implement input validation to restrict the depth of brace nesting that can be processed.
Conclusion
The brace-expansion package is vulnerable to a Denial of Service attack due to uncontrolled recursion on nested brace groups. It is crucial to update to the patched versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround to prevent exploitation.
See every vulnerability recorded for brace-expansion →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
The affected versions include 1.1.18, 2.1.4, 3.0.6, and 5.0.9.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
If exploited, the application may crash due to a RangeError caused by stack exhaustion, leading to a Denial of Service (DoS).
No, the vulnerability only poses a risk of Denial of Service; there is no risk of code execution or data exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for brace-expansion.
