npm/brace-expansion CVE-2026-102276: high 7.5, EPSS 0.35%

brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion

Action: Upgrade brace-expansion to 1.1.19 or later.

npm i brace-expansion@5.0.10

npm i brace-expansion@3.0.7

npm i brace-expansion@2.1.5

npm i brace-expansion@1.1.19

Affected

Fixed versions

Sources

• osv: GHSA-6j4f-fj2g-mc7p
• https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
• https://nvd.nist.gov/vuln/detail/CVE-2026-102276
• https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc
• https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c
• https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc
• https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3
• https://github.com/juliangruber/brace-expansion

CVE-2026-102276 · published 2026-09-29T23:44:58Z · modified 2026-09-30T00:00:03.836613572Z · JSON