CVE-2026-102276 Details

A denial-of-service vulnerability has been identified in the brace-expansion library, specifically in versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10. The issue arises in the 'parseCommaParts' function, which processes brace patterns recursively. This recursion can be exploited by crafting patterns with numerous comma-separated brace groups, causing the function to exhaust the native stack and crash the Node.js process. Additionally, the vulnerability can be triggered by using 'push.apply' to pass a large array of comma parts, bypassing the recursion but still leading to a stack overflow. The vulnerability occurs before any output is generated, allowing it to evade existing length checks. As a result, applications that use the brace-expansion library to process user-supplied input can be vulnerable to remote, unauthenticated denial-of-service attacks.

Users can upgrade to brace-expansion versions 1.1.19, 2.1.5, 3.0.7, or 5.0.10 to address this vulnerability.